Getting Data In

Monitoring symbolic links in a directory on Windows with Splunk 6.2.1, why are updates to log files not getting picked up?

maciep
Champion

We would like to consume the error log from our various SQL databases. Our SQL team does not configure the databases to log in a common directory and there could be multiple logs in multiple drives on a server. Instead of specifying all of the possible drives and resource intense recursive inputs, our SQL team tried creating a symlink for us.

They could create a symlink to each log file and store all of those symlinks in one common directory. Then we could just injest whatever is in that directory.

What i'm noticing is that on a Splunk restart, the errorlog files are read fine, but updates to those log files are not seen by Splunk. I'm just wondering if this is supposed to work as I think it should - as new data is written to target of those symlinks, splunk would realize the target file changed and consume the new log lines. And if so, am I maybe missing a setting somewhere? If it's not supposed to work or we can't get it to work, no big deal. I know I have other options to specify the various paths in inputs.

These servers are mix of Win 2003, 2008 and 2012. Splunk forwarder version 6.2.1. The symlinks are created under SQL_ERRORLOGS directory on the root of C:. Monitoring stanza is below. Any insight would be appreciated.

[monitor://C:\SQL_ERRORLOGS]
index = upmc_sql
sourcetype = sql:error
disabled = false
followSymlink = true

Thanks!

RupeshMano
Explorer

Thanks maciep,

I am trying to get dual feeds from Windows box to 2 different indexes. Please let me know if you have any approach in achieving the same apart from symlink.

0 Karma

RupeshMano
Explorer

Hi,

I am facing similar issue, does anyone had any solution to this ?

0 Karma

maciep
Champion

we never got back to implementing this approach, so i don't know of a fix....but i haven't tried in a while either.

0 Karma

RupeshMano
Explorer

Thanks maciep,

I am trying to get dual feeds from a windows box to 2 different splunk indexes. Could you please let me know if you have any approach to achieve the same apart from symbolic link.

0 Karma

mic1024
Path Finder

I have exact same problem in the same version of forwarder. New files are not seen until the forwarder is restarted. the destination directory is a symlink to another local drive on the system. we already use crcSalt = parameter.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...