Getting Data In
Highlighted

Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"?

Champion

One of my servers running a universal forwarder is spitting out this message quite frequently:

02-04-2016 16:48:49.607 -0500 INFO  WatchedFile - Resetting fd to re-extract header.

What is this telling me? Each file does have a header, which we ignore via the FIELDHEADERREGEX parameter. Is it telling me that the header is being extracted? (These files roll over quite a bit).

0 Karma
Highlighted

Re: Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"?

Ultra Champion

I imagine its just letting you know the file is being opened from the start again. Might be resulting from the crcSalt but I honestly don't know - just guessing.

Also worth noting that its an INFO log entry so its not necessarily telling you of a problem. Is there a larger issue you are trying to address and believe this to be a symptom of?

0 Karma