topic Re: Enabling python log rollover in splunk in Splunk Dev

Enabling python log rollover in splunk

keerthana_k — Mon, 28 Sep 2020 13:25:30 GMT

Hi,

I need to provide the rollover policy for the python log file present in the /opt/splunk/var/log/splunk directory. I tried adding the following stanza in log.cfg:

[python]

splunk = INFO

splunk.appserver = INFO

splunk.appserver.controllers = INFO

splunk.appserver.lib = WARN

appender.python=RollingFileAppender

appender.python.fileName=${SPLUNK_HOME}/var/log/splunk/python.log

appender.python.maxFileSize=1000 # default: 25MB (specified in bytes).

appender.python.maxBackupIndex=20

appender.python.layout=PatternLayout

appender.python.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n

category.PythonLogger=INFO,python

After these changes, I got the error:

2013-03-01 15:04:53,825 ERROR [5130763d33de8c610] root:544 - 'module' object has no attribute 'ROLLINGFILEAPPENDER'
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 96, in
splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME)
File "/opt/splunk/lib/python2.7/site-packages/splunk/init.py", line 146, in setupSplunkLogger
logging.getLogger(loggerName).setLevel(getattr(logging, level))
AttributeError: 'module' object has no attribute 'ROLLINGFILEAPPENDER'

I tried changing the category.PythonLogger=INFO,python to category.PythonLogger=INFO,A5 and also A2 but still I faced same issue. Can someone please help me with this.

Re: Enabling python log rollover in splunk

strive — Sun, 14 Apr 2013 12:17:29 GMT

Hi Keerthana,

Try this

http://dev.splunk.com/view/splunk-extensions/SP-CAAAEA9

Re: Enabling python log rollover in splunk

strive — Thu, 06 Jun 2013 19:01:51 GMT

http://dev.splunk.com/view/splunk-extensions/SP-CAAAEA9.

It works

Re: Enabling python log rollover in splunk

CurryPan — Wed, 26 Apr 2017 08:58:56 GMT

As of today, Splunk does not be designed for Python log rotation since to support python log rotation some design level changes are required and that cannot be done in maintenance releases. If you force to configure it, SplunkWed won't start correctly once you restart Splunk instance. Also you will see following error in web_services.log.

2017-04-04 15:56:02,928 ERROR   [58e34382a0701d2955c0] root:814 - 'module' object has no attribute '10' 
Traceback (most recent call last): 
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 90, in <module> 
splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME) 
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\__init__.py", line 154, in setupSplunkLogger 
logging.getLogger(loggerName).setLevel(getattr(logging, level)) 
AttributeError: 'module' object has no attribute '10'

If you need this feature, you can open a new support case as an Enhancement Request.

Re: Enabling python log rollover in splunk

dstoev — Tue, 28 May 2024 09:27:46 GMT

According to your reply and https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself splunk does not mange python.log rotation, but then how it is being rotated?

I've made python.log around 100MB with stopped splunk service and the python.log was NOT rotated. Once I've started splunk, log was immediately rotated to python.log.1, additionally the newly created python.log (size only few bites) I've also made it well over 25MB and it was rotated once again.