Failed to write usn context

[srich]

I am seeing the following errors over and over again in my splunkd.log file. I'm not sure where to go to resolve this. Any thoughts?

05-20-2010 11:15:54.163 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-admon.exe"" splunk-admon - run: Failed to write usn context. 05-20-2010 11:15:54.163 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-admon.exe"" splunk-admon - main: Failed to run ADMonitor='NearestDC', targedDC='{FQDN of DC}'

[Ledio_Ago · Accepted solution]

It sounds like Active Directory monitor program, splunk-admon.exe, couldn't save its checkpoint value, which is a USN string.

Check and see if the checkpoint file is created under:

Splunk\var\lib\splunk\persistentstorage\ADMon\NearestDC.ini

For some reason we can't write to that file.

[Ledio_Ago]

Glad to hear you got it fixed.
How did it get to that state, do you know?

[srich]

The file was there but permissions were wrong. Thanx.