topic Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log? in Getting Data In

Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

musskopf — Mon, 03 Nov 2014 01:04:57 GMT

Hello,

I noticed today that Web Access data is being logged inside the DB Connect Logfile $SPLUNK_HOME/var/log/splunk/jbridge.log. Apparently the Splunk Web server is logging the access to both files: jbridge.log and web_access.log. Is anybody experiencing the same?

If I run lsof jbridge.log I get:

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
splunkd 5307 splunk   92u   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    3w   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    4w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    3w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    4w   REG  253,2  7836435 138393 jbridge.log
python  5424 splunk    6w   REG  253,2  7836435 138393 jbridge.log

Where the PID 6363 is python /apps/splunk/etc/apps/dbx/bin/jbridge_server.py and PID 5424 is python -O /apps/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart

Looks like the Webserver is sending the messages to both handlers.

Here my Software Versions:
RedHat EL 6.5
Splunk 6.1.1
Splunk DB Connect 1.1.4

Any help is appreciated!

Cheers,
Mike M.

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

musskopf — Tue, 04 Nov 2014 01:14:40 GMT

forgot to mention, the logfile also doesn't rotate. Here my jbridge_server.conf:

[log]

filename=jbridge.log

maxCount=3

fileSize=15000000

logLevel=info

It should rotate at 15Mb but my logfile keeps growing up to 1Gb and I need to remove/rotate manually.

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

jdbtee — Mon, 10 Nov 2014 10:54:21 GMT

I have a similar issue, it is currently running @ 1GB

I cannot find any jbridge.conf

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

musskopf — Mon, 10 Nov 2014 21:05:02 GMT

I don't think there is a jbridge.conf... and the jbridge_server.conf is not there by default, need to be created at $SPLUNK_HOME/etc/apps/dbx/local

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

mchang_splunk — Mon, 28 Sep 2020 18:16:58 GMT

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

mthierbel — Fri, 05 Dec 2014 20:13:21 GMT

Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page.
http://docs.splunk.com/Documentation/DBX/1.1.5/ReleaseNotes/Releasenotes

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

shaun_dyble — Thu, 18 Dec 2014 02:18:52 GMT

Im having the same issue .. web logs are being inserted into the jbridge.log (DB Connect 1.1.4).

Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

jfarmiloe — Thu, 18 Dec 2014 02:20:41 GMT

Upgrading to DBX 1.1.5 fixed this issue for me.