I have these info messages popping up in my splunk install every couple of seconds
09-25-2012 09:37:40.378 -0500 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/logging/syslog-ng/everything'.
09-25-2012 09:37:40.378 -0500 INFO WatchedFile - Will begin reading at offset=0 for file='/logging/syslog-ng/everything'.
But the file that it is monitoring is growing nicely. Sooooo why?
Is it really re-reading the file every couple of seconds? It's a huge file; 14 gig+