Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Checksum for logs ? How to disable ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I cant forward Tomcat logs because of this strange error. This is development server so content of tomcat/logs is changing very often - sometimes we need to remove all logs to create new ones. How to disable checksum feature for development logs ?
01-14-2013 15:13:33.882 +0100 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/home/application/tomcat/logs/catalina.out). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.
Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;
crcSalt = <SOURCE>
With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.
Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;
crcSalt = <SOURCE>
With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Np, glad it helped! 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for Your help 🙂 Its working.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
