Monitoring Splunk

Checksum for logs ? How to disable ?

konradwawryn
Explorer

Hi,

I cant forward Tomcat logs because of this strange error. This is development server so content of tomcat/logs is changing very often - sometimes we need to remove all logs to create new ones. How to disable checksum feature for development logs ?

01-14-2013 15:13:33.882 +0100 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/home/application/tomcat/logs/catalina.out).  Last time we saw this initcrc, filename was different.  You may wish to use a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
1 Solution

Drainy
Champion

You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.

Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;

crcSalt = <SOURCE>

With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.

View solution in original post

Drainy
Champion

You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.

Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;

crcSalt = <SOURCE>

With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.

Drainy
Champion

Np, glad it helped! 🙂

0 Karma

konradwawryn
Explorer

Thanks for Your help 🙂 Its working.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...