How to monitor a structured XML log file without indexing duplicate events?

[schose]

Hi forum,

I'm trying to monitor an xml structured logfile like this:

<Events>
<Event>line1</Events>
<Event>line2</Events>
</Events>

When a new event is coming in, the new logentry tag is attached one line before the end.

<Events>
<Event>line1</Events>
<Event>line2</Events>
<Event>line3</Events>
</Events>

When using monitor://, the logfile is re-read completely and I end up in doubled events for every new line. The message I see in splunkd.log on the forwarder is

Checksum for seekptr didn't match, will re-read entire file file='/logs/example.logs'

Workaround to get rid of the doubled events is to logrotate very often and read the rotated log, not the recent. The rotated log will not be extended so the problem doesn't occur.

Is there better way to monitor the recent log? Tried followTail = 1 , but didn't work out.

Best Regards,

Andreas

[alemarzu · Accepted solution]

Hi @schose, read Lisa's answers please.

https://answers.splunk.com/answers/202965/has-anyone-come-across-monitoring-an-xml-logfile-t.html