Getting Data In

Splunk UF Not reading logs.

Prakash493
Communicator

Hi , I am in a situation now ,

My splunk Universal forwarder is sometimes sending the logs and sometimes its not sending the logs , i checked we have logs generated constantly on systems and checked the input path mentioned is correct. We didnt change anything last logs we got on july 1. Then we restarted couple of forwarders and reload the deployment server after some times 2 events came. Then next day no events and today on july 5 we received 5 events only which is way below. Sometimes its sending logs very few and sometimes not. I checked in internal index , splunkd logs i didnt find any error messages on splunkd logs. What might be the issue here ?

before july 1 everything was normal log ingestion inputs paths everything is same as today.

0 Karma
1 Solution

woodcock
Esteemed Legend

The most common reason for this is too many co-resident files in the same director(y|ies) as the files that you are forwarding. Typically the files are rotated and the rotated logs just hang out forever. You must not let this happen. At hundreds of files you will see great slowdown at thousands you will see complete standstill. It will be OK for a few minutes whenever you restart Splunk but it will immediately lockup. You have to get rid of those old files.

View solution in original post

woodcock
Esteemed Legend

The most common reason for this is too many co-resident files in the same director(y|ies) as the files that you are forwarding. Typically the files are rotated and the rotated logs just hang out forever. You must not let this happen. At hundreds of files you will see great slowdown at thousands you will see complete standstill. It will be OK for a few minutes whenever you restart Splunk but it will immediately lockup. You have to get rid of those old files.

View solution in original post

Prakash493
Communicator

thanks for your answer , i removed all the old logs from the main directory and restarted the forwarder and the logs came up.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!