Getting Data In
Highlighted

Universal Forwarder Crash _initCrcLen' failed.

Communicator

I have a universal forwarder running that picks up bluecoat logs from a directory. Everything works as expected, however every couple of hours the forwarder randomly crashes with the following error message in splunkd_stderr.log:

splunkd: /home/build/build-src/ivory/src/pipeline/input/ArchiveProcessor.cpp:1062: bool ArchiveCrcChecker::write(const char*, size_t): Assertion `_dataProv.curPos() < _initCrcLen' failed.

The files are compressed and contain headers which may be part of my issue but I'd like to know a bit more what this error message is referring to. The forwarder crashed almost constantly before I added the initCrcLength = 1000. I plan to try and increase this number to see if it helps but my headers only tend to be 400-500 bytes.

Inputs.conf
    [batch:///logs/proxy/splunkwatch/SG_*.log.gz]
    source = file.bluecoat
    sourcetype = bluecoat:proxysg:access:file
    disabled = false
    index = proxy
    move_policy = sinkhole
    initCrcLength = 1000

The files are unique with a date/time stamp so I thought about using crcSalt = however splunk doesn't seem to read the files at all using that.

Thoughts on what may be going on?

Highlighted

Re: Universal Forwarder Crash _initCrcLen' failed.

Ultra Champion

Which version of the forwarder are you using? We had crashes saying StatWrap::isDir() const: Assertion_valid' failed` and by upgrading from 6.3.1 to 6.5, the problem got cleared.

0 Karma
Highlighted

Re: Universal Forwarder Crash _initCrcLen' failed.

Communicator

Running a fresh install of 6.5.2

0 Karma
Highlighted

Re: Universal Forwarder Crash _initCrcLen' failed.

SplunkTrust
SplunkTrust

As a general rule, if you get an assertion that's a sign you need to submit a support case. To truly look into an assertion requires access to the source code, and few if any of us in the community have such rights.

View solution in original post