Ignoring file due to: binary

[mslvrstn]

A file on my Windows boxes (running the Universal Forwarder) is being ignored because it has some bogus non-ASCII characters in the first few lines. I understand that the way to solve this should be via props.conf:

[my-sourcetype]
NO_BINARY_CHECK = true

but that doesn't seem to work when i configure that on the forwarder.

Someone suggested that this props.conf needs to go on the indexers, but how can that be the case since the message logs on the Forwarder saying it is ignoring the file and so never gets sent to the indexer?

[reedmohn]

First thought: Did you put it in the right props.conf file? (Sorry, I don't know which one is correct, but I do see that forwarders get cranky if get that stuff wrong...)

[Ayn]

Some props.conf settings like NO_BINARY_CHECK are used by Universal and Light forwarders. From
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwardercapabilities

Does not use transforms.conf and does not fully parse incoming data, but the CHARSET, CHECK_FOR_HEADER, NO_BINARY_CHECK, PREFIX_SOURCETYPE, and sourcetype properties from props.conf are used. 

[mslvrstn]

OK, so that explains why it SHOULD work in the forwarders' props.conf, but the real problem is that it doesn't.

I can see NO_BINARY_CHECK in the output of btool props list for my_sourcetype, but when it's restarted, it still logs
08-14-2012 19:46:58.139 +0000 WARN FileClassifierManager - The file 'my_file' is invalid. Reason: binary
08-14-2012 19:46:58.139 +0000 INFO TailingProcessor - Ignoring file 'my_file' due to: binary
for every file.