Props.conf for ClamAV scan log

[jkamdar]

I have ClamAV running on all my linux hosts (universal forwarders) and all logsseems to be fine except clamav logs. ClamAV scan report has unusual log format (see below). I need help with how to ingest that report. Splunk (splunkd.log) shows error when I try to ingest it. I think, I need to setup a props.conf but I am not sure, how to go about doing it. This is an air gapped system, just FYI. 

splunkd.log

ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=/var/log/audit/clamav_scan_20240916_111846.log). Last time we saw this, filename was different. You may wish to use larger initCrcLen for this sourcetype or a CRC salt on this source.

Clamav scan generates log file as shown below:

-----------SCAN SUMMARY--------------
Known Viruses: xxxxxx
Engine Version: x.xx.x
Scanned Directories: xxx
Scanned Files: xxxxx
Infected Files: x
Data Scanned: xxxxMB
Data Read: xxxxMB
Time:
Start Date: 2024:09:16 14:46:58
End Date: 2024:09:16 16:33:06

[PickleRick]

That's understandable. Your files consist mostly of a relatively constant part repeated across all files (the header and some relatively constant fields) so Splunk will be guessing that it's all the same file.

If the filenames are unique and the files are not rotated in any way, you can use

crcSalt=<SOURCE>

(That's actually one of the rare cases it can actually make sense).

Otherwise, raise initCrcLength so that it catches variable parts of the event.

As a side note, it seems that the event is very verbose and could use some serious editing on ingest to save on license (you don't need majority of the raw data). Additional questin is whether there should be any event breaking done within a single fioe.