File monitoring issues

[remy06]

I've set splunk to monitor a log file via data inputs and it has been going on fine till recently.

When I noticed splunk had stopped receiving events since last week,I checked the actual log file but the log file is still being updated with events from today.Also didn't notice any issues in splunkd log..The log file is being updated but splunk seems to have stop indexing the events..

Any idea?

[howyagoin]

I've had this problem a number of times under Splunk 4.2, but two things have largely solved it -- one clue in my case was that restarting Splunk would typically get the file to be read again -- that's not optimal for a production environment, so, two changes I made helped considerably:

1) ignoreOlderThan = 7d

I put this in stanzas for inputs.conf where I have a lot of files that are archived - Sometimes on restart Splunk would spend hours or days trying to go through them all and consider re-indexing. By including this directive in file/directory monitoring stanzas it would allow Splunk to more speedily get to the files that were (from my point of view) being ignored)

2) crcSalt = <SOURCE>

I add this to most stanzas in inputs.conf where I'm continuously monitoring a single file - see the documentation for the various options here, but, adding this has helped me considerably in the situations you describe.