Monitoring Splunk

Splunkd error message from: FileClassifierManager

nls21
Explorer

Keep getting loads of these messages:

WARN FileClassifierManager - The file '/var/log/sa/sa25' is invalid. Reason: binary

I looked for the /var/log/sa/sa24 and found it only in the audit.log file. It’s a search run by admin. What is this and how do I eliminate the error message?

05-24-2011 15:02:25.815 -0400 INFO AuditLogger - Audit:[timestamp=05-24-2011 15:02:25.815, user=admin, action=search, info=granted , search_id='1306263745.1546', search='search /var/log/sa/sa24', autojoin='1', buckets=300, ttl=604800, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='*', apiStartTime='Tue May 24 11:00:00 2011', apiEndTime='Tue May 24 15:02:25 2011', savedsearch_name=""][n/a]

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...