We're getting bunch of these exceptions on our Universal Forwarders...any help would be appreciated and I can provide more info if needed...
1) `ERROR TailReader -File will not be read, seekptr checksum did not match`it says file will not be read. Does that mean it's ignoring the live log which is logged in the path specified..?
ERROR TailReader -File will not be read, seekptr checksum did not match (file=/opt/app/ws/server/kv_JVM01/log/responseTime.2016-05-04.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
ERROR TailReader -File will not be read, seekptr checksum did not match (file=/opt/app/ws/server/jr_LCMI/log/server.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info
2) `INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file` Does that mean it's re-indexing entire file again..?
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/app/ws/ATG-Data/home/servers/ku_JVM00/logs/apps.log'
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/app/ws/server/ra_JVM00/log/server.log'.
As soon as I restart UFs, I see the message below. What do the offset numbers mean..?
INFO WatchedFile - Will begin reading at offset=0 for file='file=/opt/app/ws/server/kv_JVM01/log/responseTime.2016-05-04.log'.
INFO WatchedFile - Will begin reading at offset=90 for file='/opt/app/ws/server/ra_JVM00/log/server.log'.
INFO WatchedFile - Will begin reading at offset=180 for file='file=/opt/app/ws/server/kv_JVM00/log/responseTime.2016-05-04.log'.
Configs on my universal forwarders:
inputs.conf
[monitor:///opt/app/ws/server/*/log/server.log]
sourcetype=log4j
index=testenv
[monitor:///opt/app/ws/server/*/log/responseTime.*.log]
Sourcetype=responseTime
index=testenv
[monitor:///opt/app/ws/ATG-Data/home/servers/*/logs/apps.log]
Sourcetype=apps
index=testenv
outputs.conf
#conpressed and useACK were not set for some of the UFs
#splhfserver is a HF which route the data to Splunk, it's not indexing locally..
[tcpout]
defaultGroup = splhfdataforwarder
compressed = true
useACK = true
[tcpout:splhfdatafowarder]
Server=splhfserver:9997
↧