Getting Data In

Checksum too small and checksum does not match - how do I fix it?

esalmon
Explorer

I keep getting these two errors when restarting the forwarder:

ERROR TailReader - File will not be read, seekptr checksum did not match

File will not be read, is too small to match seekptr checksum

I'm consuming multiple logs in the one stanza, and all of the logs either have one or both of these error messages. I am at a complete loss on how to fix this issue and its beginning to greatly frustrate me. Here is my current inputs.conf for reference:

 

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...