splunkd.log output
05-25-2014 19:58:26.249 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='<file>'.
05-25-2014 19:58:58.155 +0000 INFO BatchReader - Removed from queue file='<file>'.
The file is a couple hundred MB's.
Scenario, the file is scp to the forwarder server. Data is not viewable.
What could cause this error, as it has happened repeatedly with the same file.
As soon as Splunk sees the file in the directory, it tries to start indexing. My guess is that Splunk started to index before any data was actually written to the file.
It also appears that you were copying the file to a directory for splunk to "index once" or "batch load."
So Splunk will only take one shot at files in this directory.
If you were monitoring the directory instead, it probably would have worked. Here are a couple of alternatives:
1 - Use monitor
Use [monitor://]
instead of batch in your inputs.conf
Write a script to remove the files from the directory after 24 hours or 7 days or whatever makes sense.
2 - Use two directories
Leave the batch
in inputs.conf
scp
the file to a different directory, then mv
it to the batch directory. Otherwise, Splunk may hit EOF before the complete file is copied.
As soon as Splunk sees the file in the directory, it tries to start indexing. My guess is that Splunk started to index before any data was actually written to the file.
It also appears that you were copying the file to a directory for splunk to "index once" or "batch load."
So Splunk will only take one shot at files in this directory.
If you were monitoring the directory instead, it probably would have worked. Here are a couple of alternatives:
1 - Use monitor
Use [monitor://]
instead of batch in your inputs.conf
Write a script to remove the files from the directory after 24 hours or 7 days or whatever makes sense.
2 - Use two directories
Leave the batch
in inputs.conf
scp
the file to a different directory, then mv
it to the batch directory. Otherwise, Splunk may hit EOF before the complete file is copied.
Hi lguinn,
I'm getting bunch of there messages on our UFs.....
INFO WatchedFile -File too small to check seekcrc, probably truncated. Will re-read entire file=.'<filepath>'
INFO WatchedFile - Logfile truncated while open, original pathname file=.'<filepath>'. , will begin reading from start.
I have my inputs.conf in here i did tried with followTail and initCrcLength which doesn't work to get rid of the above messages..
[monitor:///opt/app/ws/server/*/log/server.log]
sourcetype=log4j
crcSalt = <SOURCE>
index=testenv
The actual path of the monitor stanza would include..
[monitor:///opt/app/ws/server/*/log/server.log]
/opt/app/ws/server/ra_JVM00/log/server.log
/opt/app/ws/server/ra_JVM01/log/server.log
/opt/app/ws/server/pr_INS00/log/server.log
/opt/app/ws/server/pr_INS02/log/server.log
The logs get rotated/saved as e.g:/opt/app/ws/server/ra_JVM00/log/server.log.2016-05-08, i don't think splunk will read this as we did not give that in monitor stanza.
Can you please shed some light on this...?
I would have to scp the file again in order for splunk to index it. Why did the first time not work?