Monitoring Splunk

Why did my Splunkforwarder stop with the error "WatchedFile - About to assert due to: destroying state while still cached..." in the splunkd.log?

New Member

Splunkforwarder stops with the below error in the splunkd.log:

0500 ERROR WatchedFile - About to assert due to: destroying state while still cached: state=0x0x7f0e5991c780 wtf=0x0x7f0e5992f200 off=0 initcrc=0xeecf05
88f22411cc scrc=0x0 fallbackcrc=0x0 last_eof_time=1424150223 reschedule_target=0 is_cached=343536 fd_valid=true exists=true last_char_newline=true on_block_boundary=true only_no
tified_once=false was_replaced=true eof_seconds=3 unowned=false always_read=false was_too_new=false is_batch=true name="/var/log/mongo/rotated/mongod.log.2015-02-17.1424150222"
0 Karma

Splunk Employee
Splunk Employee

This is a Known Issue, SPL-94913 and fixed in Splunk 6.2.2.

0 Karma


I downvoted this post because we are running splunk 6.4.0 and have the same issue.

0 Karma

Path Finder

I know this mean the file was in a transient state but I need a work-around for this also. It seem splunk should just drop the file and
go on.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.