Getting Data In

WARN FileClassifierManager: The file is invalid. Reason: cannot_open

leticiamartello
New Member

I have a watched file on a Universal Forwarder (Windows) and the file is send to the Heavy Forwarder (linux), but some file are not indexed, and some are indexed. This is the configuration on inputs.conf (Heavy Forwarder):

[monitor://D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxxx_xxxxxx_*.CSV]
index=index_xxx
source=ccc:ccc
sourcetype=ccc:ccc
disabled = 0
time_before_close = 60
multiline_event_extra_waittime = true
initCrcLength = 512

I'm getting these errors:

11/1/19 7:33:12.398 PM11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx  index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/197:33:12.398 PM 11-01-2019 19:33:12.398 -0300 ERROR TailReader - error from read call from 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = SRVCNFS02index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM  11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'.

Does anyone know what is wrong?

Thnak you!

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Splunk cannot read the file because it does not have the required permissions.
Though I'm not a Windows guru (far from it), this is similar to Splunk running as the "splunk" user, and trying to monitor files owned by root.
Change the ownership or privileges on the directory, or change the account that Splunk itself runs as.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

corey_dick
Path Finder

I'm having the same issue.  I double checked and the account that Splunk is running under has Full Control of both the file and the folder.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...