https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85311#M17752 <P><A href="http://linuxcommand.org/man_pages/logrotate8.html">logrotate</A></P> Thu, 04 Apr 2013 19:19:23 GMT jonuwz 2013-04-04T19:19:23Z https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85310#M17751 <P>How do I deal with large syslog files that keep growing?<BR /> Do I just delete them or is there an automated way of rolling them. I don't want to lose the data or disconnect the hosts sending it.</P> Thu, 04 Apr 2013 19:08:09 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85310#M17751 craigrussell 2013-04-04T19:08:09Z https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85311#M17752 <P><A href="http://linuxcommand.org/man_pages/logrotate8.html">logrotate</A></P> Thu, 04 Apr 2013 19:19:23 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85311#M17752 jonuwz 2013-04-04T19:19:23Z https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85312#M17753 <P>Thanks for the tip. I'll try it.</P> Fri, 05 Apr 2013 15:04:01 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85312#M17753 craigrussell 2013-04-05T15:04:01Z https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85313#M17754 <P>I agree with the answer above.</P> <P>Man Page:<BR /> <A href="http://linuxcommand.org/man_pages/logrotate8.html">http://linuxcommand.org/man_pages/logrotate8.html</A></P> <P>Tutorial Step-by-Step<BR /> <A href="http://www.thegeekstuff.com/2010/07/logrotate-examples/">http://www.thegeekstuff.com/2010/07/logrotate-examples/</A></P> Fri, 05 Apr 2013 15:34:54 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85313#M17754 borisalves 2013-04-05T15:34:54Z https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85314#M17755 <P>Note that in the Splunk context, you probably want the "delaycompress" option, so that rotated log files can be correctly identified, and read to the end of the file <EM>even</EM> after the file has been rotated.</P> Fri, 05 Apr 2013 16:45:58 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-files-growing-out-of-control/m-p/85314#M17755 sowings 2013-04-05T16:45:58Z