Monitoring Splunk

Splunkd error message from: FileClassifierManager

nls21
Explorer

Keep getting loads of these messages:

WARN FileClassifierManager - The file '/var/log/sa/sa25' is invalid. Reason: binary

I looked for the /var/log/sa/sa24 and found it only in the audit.log file. It’s a search run by admin. What is this and how do I eliminate the error message?

05-24-2011 15:02:25.815 -0400 INFO AuditLogger - Audit:[timestamp=05-24-2011 15:02:25.815, user=admin, action=search, info=granted , search_id='1306263745.1546', search='search /var/log/sa/sa24', autojoin='1', buckets=300, ttl=604800, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='*', apiStartTime='Tue May 24 11:00:00 2011', apiEndTime='Tue May 24 15:02:25 2011', savedsearch_name=""][n/a]

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...