topic Re: Reading database logs from linux server in Getting Data In

Reading database logs from linux server

islam — Thu, 11 Jun 2020 12:19:04 GMT

Hi,

We want to read the database logs from a linux server, and the logs are stored in specific path “</path>/log/” as example . The logs are archived at the end of every day in same directory of real time log file. The real time info writes into “vertica.log” file, so we don’t want to read logs from the file “vertica.log”

How can we reed this archived files in splunk.

Re: Reading database logs from linux server

venkateshparank — Thu, 11 Jun 2020 22:22:35 GMT

Create monitoring stanza like below:

[monitor:///<path>/log/vertica.log-*]

disabled = 0

crcSalt = <SOURCE>

index = <IndexName>

If you still see the vertica.log is reading, trying adding below line in above Stanza

blacklist = vertica.log

That would be like below:

[monitor:///<path>/log/vertica.log-*]

disabled = 0

crcSalt = <SOURCE>

index = <IndexName>

blacklist = vertica.log

Re: Reading database logs from linux server

islam — Sat, 11 Jul 2020 21:25:27 GMT

thanks a lot for your kindly reply.

we tried this solution and we start receiving logs now.

Re: Reading database logs from linux server

venkateshparank — Sat, 11 Jul 2020 22:09:34 GMT

@islam If the solution helps you, then an upvote would be appreciated.