Archive
Highlighted

Ignoring file due to: binary

Communicator

A file on my Windows boxes (running the Universal Forwarder) is being ignored because it has some bogus non-ASCII characters in the first few lines. I understand that the way to solve this should be via props.conf:

[my-sourcetype]
NO_BINARY_CHECK = true

but that doesn't seem to work when i configure that on the forwarder.

Someone suggested that this props.conf needs to go on the indexers, but how can that be the case since the message logs on the Forwarder saying it is ignoring the file and so never gets sent to the indexer?

Tags (2)
Highlighted

Re: Ignoring file due to: binary

Legend

Some props.conf settings like NO_BINARY_CHECK are used by Universal and Light forwarders. From
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwardercapabilities

Does not use transforms.conf and does not fully parse incoming data, but the CHARSET, CHECK_FOR_HEADER, NO_BINARY_CHECK, PREFIX_SOURCETYPE, and sourcetype properties from props.conf are used. 
Highlighted

Re: Ignoring file due to: binary

Communicator

OK, so that explains why it SHOULD work in the forwarders' props.conf, but the real problem is that it doesn't.

I can see NOBINARYCHECK in the output of btool props list for mysourcetype, but when it's restarted, it still logs
08-14-2012 19:46:58.139 +0000 WARN FileClassifierManager - The file 'my
file' is invalid. Reason: binary
08-14-2012 19:46:58.139 +0000 INFO TailingProcessor - Ignoring file 'my_file' due to: binary
for every file.

0 Karma
Highlighted

Re: Ignoring file due to: binary

Communicator

First thought: Did you put it in the right props.conf file? (Sorry, I don't know which one is correct, but I do see that forwarders get cranky if get that stuff wrong...)

0 Karma