|
I'm seeing "seekptr checksum" errors for all the Microsoft's DHCP log files. Here's an example: ERROR TailingProcessor - Ignoring path due to: File will not be read, is too small to match seekptr checksum (file=\dhcpsrv\dhcp$\DhcpSrvLog.Tue). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or contact Splunk Support for more info. I'm a little unsure of how to use the crcSalt option that's suggested in the Admin Manual. Here's what I have in the inputs.conf file: Did I correctly defined the crcSalt parameter? FYI, Microsoft's DHCP service writes its events to 7 different files, one for each day of the week. Thanks. -w |
|
You should use - Don't replace with anything, type it exactly as I have done here. This setting adds a string to the CRC of the file being monitored. If you set it to a specific source string like you have above, then the same string will be added to every file being monitored by that stanza. By setting it to , each file's individual source path will be added to the CRC, ensuring that each one will be different. This setting is case-sensitive, so make sure you use UPPERCASE characters. Disclaimer - applying this setting to files that have already been indexed will cause them to be re-indexed as the CRC will change. Likewise, if you roll a live file and save the old data in the same directory that you're monitoring, that file will be re-indexed as soon as the filename changes. So if you roll your files to *.log.1, or you gzip them to *.log.gz, make sure you add an Thank you. I misread the example and thought that the SOURCE tag is a variable that needs to be replaced by the source file being monitored. Problem solved!
(13 May '10, 14:25)
williamche
|
|
I think it's a mistake in how I'd entered the crcSalt option. I modified it to the following and now I'm getting all the events: I thought the "" tag used in the examples means I need to replace it with the path to the source files. I also addded a _whitelist parameter to monitor only those 7 files. It's working so far. |
|
BTW, the issue is we recognize files by their contents, and these logs all have the same header. This setting essentially tells splunk "different filenames will have different contents". Or another way of looking at it "my files don't roll, they're new names by date, and don't get renamed." |