How can you tell the difference between a light forwarder and a full forwarder in Splunk's internal logs?

[Jason]

I have a forwarder that appears to be a LWF (SplunkLightForwarder app is enabled) however I am seeing messages about unable to send to output queue parsingQueue. I thought the LWFs didn't do parsing.

How do I tell from Splunk's logs (splunkd.log, others?) that this is definitely a light forwarder and not attempting to parse events, perhaps through an errant setting somewhere?

[LCM · Accepted solution]

I checked something out on my "newly" created LWF on Sol.10 x86 with Splunk 4.1.7:

/usr/xpg4/bin/grep -E 'Splunkd starting|controlqueueoutput' $SPLUNK_HOME/var/log/splunk/splunkd.log

03-17-2011 20:31:14.482 INFO  loader - Splunkd starting (build 95063).
03-17-2011 20:48:06.492 INFO  loader - Splunkd starting (build 95063).
03-17-2011 20:53:55.356 INFO  loader - Splunkd starting (build 95063).
03-17-2011 20:58:52.969 INFO  loader - Splunkd starting (build 95063).
03-17-2011 20:59:03.029 INFO  loader - Instantiated plugin: controlqueueoutputprocessor

Only, LWF shows controlqueueoutputprocessor, regular forwarders dont - means, my last boot was as LWF!

Note: You'd have checked splunk status (splunkwebd isn't running on a LWF), but you asked for the splunkd.log

[Jason]

Great - yes, I control splunkweb independently of LWF sometimes, so I wanted to know from splunkd.log.