WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file

[ben_leung]

splunkd.log output

05-25-2014 19:58:26.249 +0000 INFO  WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='<file>'.

05-25-2014 19:58:58.155 +0000 INFO  BatchReader - Removed from queue file='<file>'.

The file is a couple hundred MB's.

Scenario, the file is scp to the forwarder server. Data is not viewable.

What could cause this error, as it has happened repeatedly with the same file.

[lguinn2 · Accepted solution]

As soon as Splunk sees the file in the directory, it tries to start indexing. My guess is that Splunk started to index before any data was actually written to the file.

It also appears that you were copying the file to a directory for splunk to "index once" or "batch load."
So Splunk will only take one shot at files in this directory.

If you were monitoring the directory instead, it probably would have worked. Here are a couple of alternatives:

1 - Use monitor

Use [monitor://] instead of batch in your inputs.conf

Write a script to remove the files from the directory after 24 hours or 7 days or whatever makes sense.

2 - Use two directories

Leave the batch in inputs.conf

scp the file to a different directory, then mv it to the batch directory. Otherwise, Splunk may hit EOF before the complete file is copied.

[prakash007]

Hi lguinn,

I'm getting bunch of there messages on our UFs.....

INFO  WatchedFile -File too small to check seekcrc, probably truncated.  Will re-read entire file=.'<filepath>'

INFO  WatchedFile - Logfile truncated while open, original pathname file=.'<filepath>'. , will begin reading from start.

I have my inputs.conf in here i did tried with followTail and initCrcLength which doesn't work to get rid of the above messages..

 [monitor:///opt/app/ws/server/*/log/server.log]
 sourcetype=log4j
 crcSalt = <SOURCE>
 index=testenv

The actual path of the monitor stanza would include..

[monitor:///opt/app/ws/server/*/log/server.log]

/opt/app/ws/server/ra_JVM00/log/server.log
/opt/app/ws/server/ra_JVM01/log/server.log
/opt/app/ws/server/pr_INS00/log/server.log
/opt/app/ws/server/pr_INS02/log/server.log

The logs get rotated/saved as e.g:/opt/app/ws/server/ra_JVM00/log/server.log.2016-05-08, i don't think splunk will read this as we did not give that in monitor stanza.

Can you please shed some light on this...?

[ben_leung]

I would have to scp the file again in order for splunk to index it. Why did the first time not work?