Monitoring Splunk

Splunkd error message from: FileClassifierManager

nls21
Explorer

Keep getting loads of these messages:

WARN FileClassifierManager - The file '/var/log/sa/sa25' is invalid. Reason: binary

I looked for the /var/log/sa/sa24 and found it only in the audit.log file. It’s a search run by admin. What is this and how do I eliminate the error message?

05-24-2011 15:02:25.815 -0400 INFO AuditLogger - Audit:[timestamp=05-24-2011 15:02:25.815, user=admin, action=search, info=granted , search_id='1306263745.1546', search='search /var/log/sa/sa24', autojoin='1', buckets=300, ttl=604800, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='*', apiStartTime='Tue May 24 11:00:00 2011', apiEndTime='Tue May 24 15:02:25 2011', savedsearch_name=""][n/a]

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...