ERROR TailingProcessor - matching ...

[annebeate]

Hi,

After upgrading splunk forwarder from version 4.2.1 to 4.3.1, the Splunk indexer does not receive any data. The indexer has the 4.3.1 version installed. I think the issue is related to symlinks. The monitored files have a symlink included: "current_release". I've tested that I'm able to forward data not including symlinks.

Error message:

05-11-2012 11:32:48.836 +0200 ERROR TailingProcessor - matching /progs/cosmos/cos/releases/domain_Cos69/release_69.0.0_dummy/ against ^/progs/cosmos/cos/releases/domain_Cos[^/]*/current_release/servers/CM[^/]*/config/Cos[^/]*/CM[^/]*/logs/[^/]*\.log$

Extract from inputs.conf:

[monitor:///progs/cosmos/cos/releases/domain_Cos*/current_release/CM*/startCM.sh_out]
disabled = false
sourcetype = cos_weblogic_stdout
index = s00386_cos_test_sys
crcSalt=/progs/cosmos/cos/releases/domain_Cos38/current_release/CM1/startCM.sh_out
crcSalt=/progs/cosmos/cos/releases/domain_Cos39/current_release/CM1/startCM.sh_out

[monitor:///progs/cosmos/cos/releases/domain_Cos*/current_release/CM*/logs/jmsSender.log*]
disabled = false
_blacklist = .*\.gz$
index = s00386_cos_test_app
sourcetype=cos_log4j

[annebeate]

Hi,

Yes, the forwarder hasn't been sending any data since the 7th of May after reinstall of Splunk forwarder.

Regards,
Anne Beate

[yannK]

If you are as splunk enterprise customer, I recommend to fill a support case.

Otherwise, check any permissions issues no the forwarder side, change your monitor stanza.
and use the secret REST API on the forwarder to check the forwarder tailing processor. (as splunk admin, change the password before if needed)

https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus

[yannK]

Hi Annebeate

This error message is a known issue, SPL-47988 " ERROR TailingProcessor - matching X against Y "
The message has in incorrect log level, and is not a legitimate error message and can be disregarded. It will be fixed in the version 4.3.4

Are you experiencing missing events from the monitored log files ?

Regards,
Splunk Support