Monitoring Splunk

Checksum for logs ? How to disable ?

konradwawryn
Explorer

Hi,

I cant forward Tomcat logs because of this strange error. This is development server so content of tomcat/logs is changing very often - sometimes we need to remove all logs to create new ones. How to disable checksum feature for development logs ?

01-14-2013 15:13:33.882 +0100 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/home/application/tomcat/logs/catalina.out).  Last time we saw this initcrc, filename was different.  You may wish to use a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
1 Solution

Drainy
Champion

You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.

Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;

crcSalt = <SOURCE>

With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.

View solution in original post

Drainy
Champion

You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.

Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;

crcSalt = <SOURCE>

With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.

Drainy
Champion

Np, glad it helped! 🙂

0 Karma

konradwawryn
Explorer

Thanks for Your help 🙂 Its working.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...