https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13050#M205 <P>You can tune the log levels and sizes in $SPLUNK_HOME/etc/log.cfg. After editing this file, you will need to restart Splunk.</P> <P>The specific parameters you will want to edit are the maxFileSize and maxBackupIndex under each file type.</P> <P>I recommend you retain as much data as you can since this data is very useful for troubleshooting problems. </P> Fri, 07 May 2010 00:55:56 GMT Simeon 2010-05-07T00:55:56Z https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13049#M204 <P>Hey Guys, </P> <P>Just noticed that logging on one of my light forwarders is taking up a lot of space:</P> <P>myhost[05:15 PM]root:/opt/splunk/var/log/splunk# ls -lh</P> <P>total 113M </P> <P>116K -rw------- 1 root root 111K May 6 17:10 audit.log<BR /> 0 -rw------- 1 root root 0 Apr 26 15:13 btool.log<BR /> 4.0K -rw------- 1 root root 61 Apr 26 15:13 first_install.log<BR /> 0 -rw------- 1 root root 0 Apr 26 15:31 intentions.log<BR /> 12K -rw------- 1 root root 9.5K May 6 17:10 license_audit.log<BR /> 15M -rw------- 1 root root 15M May 6 17:15 metrics.log<BR /> 24M -rw------- 1 root root 24M May 5 10:12 metrics.log.1<BR /> 24M -rw------- 1 root root 24M May 3 05:22 metrics.log.2<BR /> 24M -rw------- 1 root root 24M May 1 00:30 metrics.log.3<BR /> 24M -rw------- 1 root root 24M Apr 28 19:48 metrics.log.4<BR /> 0 -rw------- 1 root root 0 Apr 26 15:31 scheduler.log<BR /> 0 -rw------- 1 root root 0 Apr 26 15:31 searches.log<BR /> 0 -rw------- 1 root root 0 Apr 26 15:31 searchhistory.log<BR /> 2.0M -rw------- 1 root root 2.0M May 6 17:10 splunkd.log<BR /> 556K -rw------- 1 root root 551K May 6 17:10 splunkd_access.log<BR /> 4.0K -rw------- 1 root root 110 May 6 17:09 splunkd_stderr.log<BR /> 0 -rw------- 1 root root 0 Apr 26 15:31 splunkd_stdout.log<BR /> 0 -rw------- 1 root root 0 Apr 26 15:31 splunklogger.log<BR /> 36K -rw------- 1 root root 33K Apr 26 15:36 web_access.log<BR /> 20K -rw------- 1 root root 19K Apr 26 15:36 web_service.log </P> <P>I don't care too much for these logs since I simply want light forwarder to forward system and application logs to my central log servers. </P> <P>Anyway to fix this?</P> <P>Let me know. </P> <P>Thanks. </P> <P>B</P> Fri, 07 May 2010 00:38:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13049#M204 balbano 2010-05-07T00:38:44Z https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13050#M205 <P>You can tune the log levels and sizes in $SPLUNK_HOME/etc/log.cfg. After editing this file, you will need to restart Splunk.</P> <P>The specific parameters you will want to edit are the maxFileSize and maxBackupIndex under each file type.</P> <P>I recommend you retain as much data as you can since this data is very useful for troubleshooting problems. </P> Fri, 07 May 2010 00:55:56 GMT https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13050#M205 Simeon 2010-05-07T00:55:56Z https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13051#M206 <P>Additional info on this top is available here:</P> <P><A href="http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint" rel="nofollow">http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint</A></P> Wed, 12 May 2010 03:07:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Minimizing-logging-on-Splunk-Light-Forwarder/m-p/13051#M206 Lowell 2010-05-12T03:07:44Z