Monitoring Splunk

Splunkd error message from: FileClassifierManager

nls21
Explorer

Keep getting loads of these messages:

WARN FileClassifierManager - The file '/var/log/sa/sa25' is invalid. Reason: binary

I looked for the /var/log/sa/sa24 and found it only in the audit.log file. It’s a search run by admin. What is this and how do I eliminate the error message?

05-24-2011 15:02:25.815 -0400 INFO AuditLogger - Audit:[timestamp=05-24-2011 15:02:25.815, user=admin, action=search, info=granted , search_id='1306263745.1546', search='search /var/log/sa/sa24', autojoin='1', buckets=300, ttl=604800, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='*', apiStartTime='Tue May 24 11:00:00 2011', apiEndTime='Tue May 24 15:02:25 2011', savedsearch_name=""][n/a]

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You've probably got an input defined to look at /var/log/ and index the contents of it.

Splunk is looking at this file and telling you that it will not index '/var/log/sa/sa25' because it is binary. By default splunk doesn't index binary data, because it isn't going to be useful to you when you try to view it inside of Splunk.

This isn't really an error message, its just a warning telling you how Splunk is dealing with a file that it thinks it should index. You can safely ignore the warning, or you can blacklist the files from the input which is telling Splunk to read the data.

http://www.splunk.com/base/Documentation/latest/Data/Whitelistorblacklistspecificincomingdata

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...