Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: Checksum for logs ? How to disable ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I cant forward Tomcat logs because of this strange error. This is development server so content of tomcat/logs is changing very often - sometimes we need to remove all logs to create new ones. How to disable checksum feature for development logs ?
01-14-2013 15:13:33.882 +0100 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/home/application/tomcat/logs/catalina.out). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.
Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;
crcSalt = <SOURCE>
With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.
Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;
crcSalt = <SOURCE>
With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Np, glad it helped! 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for Your help 🙂 Its working.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
