Splunk Forwarder preventing application from logging

[ebuljan]

Our Splunk Forwarder on Windows Server is monitoring 2 folders containing approximately 1k log files total. I am ignoring the vast majority of the files. Each log file is fairly large, and is constantly being written to. Each one contains a day's worth of data, about 24k lines of text when the day is over.

When the Splunk Forwarder is on, the application that logs to it seems to skip logging intermittent lines of text. When it is off, all lines are logged.

Our inputs.conf file is very sparse:

[monitor://C:\Data\Import\log\*.log]
ignoreOlderThan = 2d 

[monitor://C:\Data\Export\log\*.log]
ignoreOlderThan = 2d 

Any suggestions?

[ebuljan]

To clarify, Splunk is logging everything in the log files that it is monitoring, as expected.

But when the Splunk Forwarder is on, there are gaps in the log files.

[esix_splunk]

Does this log file get written to the top (head) of the file, or appended to the end of the file?

Take a look at CRCSALT or or FollowTail options for inputs.conf.

See here : https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Howlogfilerotationishandled

[ebuljan]

Thanks for your response. They are being written to the bottom.

A new file with a new name is created every day, so it doesn't sound like the CRC or FollowTail options would help in this case: "Do not use followTail for rolling log files (log files that get renamed as they age)..."

[MuS]

It might be also worth to check for anti virus software doing things ....

[cpetterborg]

Any pertinent information in the Windows Application logs?

[ebuljan]

Nothing special in there