Forwarder is reading a file that doesn't match the whitelist

[mikelanghorst]

I added a directory to monitor, with whitelist = log$

Later after seeing a file I didn't want to include was also being written, I modified this whitelist = startup.log. The other file that doesn't match is still being read, even with the splunkd process being restarted twice.

Here's my current monitor stanza:

[monitor:///app/actional/logs]
whitelist=startup\.log$
sourcetype=actional_startup
index=temp_syslog
disabled = 0

If I look at the TailingProcessor via the REST api, it confirms that the other files are not matching the whitelist:
/app/actional/logs/ActionalIntermediary_20110927_083150_283.log

parent  /app/actional/logs
type    Did not match whitelist 'startup.log$'.

However, searching:
index=temp_syslog source=/app/actional/logs/* NOT source=/app/actional/logs/startup.log does return events from this host matching that ActionalIntermediary log that the TailingProcessor says does not match.

Ideas on what could be wrong?

[amrit · Accepted solution]

I'd bet the events being returned are events that were indexed during the run with the incorrect whitelist - check the tailing status endpoint now for the ActionalIntermediary files...

[mikelanghorst]

Yep, I had used the "All-Time" when performing a |delete operation. So the data I was seeing later was there from before changing the whitelist.

[hexx]

Your whitelist and inputs.conf stanza seem legit. Are you sure that the events returned by the search were not indexed before the new whitelist came into effect?