I have a universal forwarder running that picks up bluecoat logs from a directory. Everything works as expected, however every couple of hours the forwarder randomly crashes with the following error message in splunkd_stderr.log:
splunkd: /home/build/build-src/ivory/src/pipeline/input/ArchiveProcessor.cpp:1062: bool ArchiveCrcChecker::write(const char*, size_t): Assertion `_dataProv.curPos() < _initCrcLen' failed.
The files are compressed and contain headers which may be part of my issue but I'd like to know a bit more what this error message is referring to. The forwarder crashed almost constantly before I added the initCrcLength = 1000. I plan to try and increase this number to see if it helps but my headers only tend to be 400-500 bytes.
Inputs.conf [batch:///logs/proxy/splunkwatch/SG_*.log.gz] source = file.bluecoat sourcetype = bluecoat:proxysg:access:file disabled = false index = proxy move_policy = sinkhole initCrcLength = 1000
The files are unique with a date/time stamp so I thought about using crcSalt = however splunk doesn't seem to read the files at all using that.
Thoughts on what may be going on?
Which version of the forwarder are you using? We had crashes saying
StatWrap::isDir() const: Assertion_valid' failed` and by upgrading from 6.3.1 to 6.5, the problem got cleared.
As a general rule, if you get an assertion that's a sign you need to submit a support case. To truly look into an assertion requires access to the source code, and few if any of us in the community have such rights.