Security

Permissions on monitored files

RicoSuave
Builder

If permissions get changed on a log file that is being monitored by splunk and becomes unreadable, will Splunk give up permanently on rechecking the readability of the log without an agent restart? Just wondering what the testing logic is and whether the agent will resume collecting the logs once the log file permissions are returned to readable?

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

The behavior changed in 4.3.3, before the Tailing processor was trying 10 times to read a file then gave up (if permission were restrictives or the file locked). So the only way was to restart the forwarder to redetect the file (or use the REST endpoint to reload the tailing processor)

Since late 4.3.3 and 5.0.*, the Tailing processor retry after in interval of time, this interval increase with each failure to maximum of 34 minutes.

see http://docs.splunk.com/Documentation/Splunk/4.3.4/ReleaseNotes/4.3.3

When tailing files, consecutive failures for accessing or handling the same pathname will result in a doubling interval up to 0.5s * 2^(12), or 1 * 2^(11) seconds or 2048 seconds, or 34 minutes and 8 seconds. If more errors are encountered, the timer will remain at 34 minutes and 8 seconds. (SPL-50995)

View solution in original post

yannK
Splunk Employee
Splunk Employee

The behavior changed in 4.3.3, before the Tailing processor was trying 10 times to read a file then gave up (if permission were restrictives or the file locked). So the only way was to restart the forwarder to redetect the file (or use the REST endpoint to reload the tailing processor)

Since late 4.3.3 and 5.0.*, the Tailing processor retry after in interval of time, this interval increase with each failure to maximum of 34 minutes.

see http://docs.splunk.com/Documentation/Splunk/4.3.4/ReleaseNotes/4.3.3

When tailing files, consecutive failures for accessing or handling the same pathname will result in a doubling interval up to 0.5s * 2^(12), or 1 * 2^(11) seconds or 2048 seconds, or 34 minutes and 8 seconds. If more errors are encountered, the timer will remain at 34 minutes and 8 seconds. (SPL-50995)

piebob
Splunk Employee
Splunk Employee

LIKE A SIR

0 Karma

RicoSuave
Builder

Thank you, le sir!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...