Getting Data In

Why do I keep getting "INFO TailReader - File descriptor cache is full (100), trimming..." in the splunkd.log on a heavy forwarder?

tkwaller
Builder

Hello

Getting what I would think is an error, but its listed as info level, not sure what it means

INFO  TailReader - File descriptor cache is full (100), trimming...

Can someone tell me what this message means please?
Thanks

0 Karma
1 Solution

mataharry
Communicator

the forwarder is tailing up to 100 files (filed descriptors open at the same time), and explains that it has more than 100 files to monitor, so it will close open files to be able to open and scan the other files.

It's an INFO event, nothing much to worry about.

View solution in original post

mataharry
Communicator

the forwarder is tailing up to 100 files (filed descriptors open at the same time), and explains that it has more than 100 files to monitor, so it will close open files to be able to open and scan the other files.

It's an INFO event, nothing much to worry about.

tkwaller
Builder

Cool, thanks for the explanation. I appreciate it

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...