I am writing a splunk forwarder to our own splunk instance. For some reason, my logs are not shipping and its frustrating. The docker instance we have is fargate so I can not ssh into the instance and debug whether the logs exist.
One of my splunkforwarder logs indicated
WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file
Does this mean it sees this file/this file existed? I want to make sure that my multicontainer are working as -
A and B - where B is the splunkforwarder
A is wring to the location (/app/logs) - means this file must have been created by A
B using VolumeFrom is about to mount the volume from A