Splunkd error message from: FileClassifierManager

[nls21]

Keep getting loads of these messages:

WARN FileClassifierManager - The file '/var/log/sa/sa25' is invalid. Reason: binary

I looked for the /var/log/sa/sa24 and found it only in the audit.log file. It’s a search run by admin. What is this and how do I eliminate the error message?

05-24-2011 15:02:25.815 -0400 INFO AuditLogger - Audit:[timestamp=05-24-2011 15:02:25.815, user=admin, action=search, info=granted , search_id='1306263745.1546', search='search /var/log/sa/sa24', autojoin='1', buckets=300, ttl=604800, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='*', apiStartTime='Tue May 24 11:00:00 2011', apiEndTime='Tue May 24 15:02:25 2011', savedsearch_name=""][n/a]

[jbsplunk · Accepted solution]

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata