Getting Data In

Why are my logfiles re-indexing due to a failed seekptr checksum?

jjclark
Engager

I have a collection of log files (InDesign Server logs) that I'm indexing with the following inputs.conf settings:

[monitor:///path/to/files/*.log]
disabled = 0
crcSalt =
followTail = 0
host = myhost
index = myindex

Everything seems to be OK, but then after some interval, I start to see these messages in splunkd.log:

03-16-2012 15:42:08.152 -0400 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/path/to/files/indesignserver.log'

It's causing many duplicate entries in my index as the same files keep getting re-indexed. Does anybody have any thoughts on why the seekptr checksum would fail?

cvajs
Contributor
0 Karma

sowings
Splunk Employee
Splunk Employee

What is this ... 'grep'?

0 Karma

nathanh42
Explorer

Not the same issue. I don't have those messages for the files in question (only for metrics.log).

! [siteadm@sun-ops1] grep "Checksum for seekptr didn't match" *log
splunkd.log:02-10-2012 04:27:19.875 +1100 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/opt/splunkforwarder/var/log/splunk/metrics.log'.

! [siteadm@sun-ops1] grep "Checksum for seekptr didn't match" *log | grep -v metrics.log
! [siteadm@sun-ops1]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...