I am writing a splunk forwarder to our own splunk instance. For some reason, my logs are not shipping and its frustrating. The docker instance we have is fargate so I can not ssh into the instance and debug whether the logs exist.
One of my splunkforwarder logs indicated
WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file
Does this mean it sees this file/this file existed? I want to make sure that my multicontainer are working as -
A and B - where B is the splunkforwarder
- A is wring to the location (/app/logs) - means this file must have been created by A
- B using VolumeFrom is about to mount the volume from A
- B has access to the logs within /app/logs/
