topic Re: How efficiently log files can be handled? in Installation

How efficiently log files can be handled?

ansif — Wed, 16 Oct 2019 11:23:29 GMT

We have spotlight which can write logs to a file. How can we manage log file size in Linux and Windows OS?

Need to rotate log files in Linux and Windows without breaking events.

Re: How efficiently log files can be handled?

gcusello — Wed, 16 Oct 2019 11:43:56 GMT

Hi ansif,
sorry, but I don't understand your question: Splunk reads logs from files, if you need to rotate files isn't a Splunk problem, when you rotate a file Splunk will start to ingest logs from the new one without ingesting the old logs.

Ciao.
Giuseppe

Re: How efficiently log files can be handled?

ansif — Wed, 16 Oct 2019 11:48:03 GMT

Ya not a splunk problem. I am asking how can we ensure as a best practice from OS perspective to rotate logs and last event in the log file is not broken.

Re: How efficiently log files can be handled?

gcusello — Wed, 30 Sep 2020 02:33:38 GMT

Hi ansif,
as I said Splunk solves this problem because it reads the old file until it's rotated, then start to read the new one (probably with the same name) and doesn't read the old one.
Obviously if after rotation the new logs are in a file with a different name, you have to build your input in appropriate mode using *, e.g. if I have my files called myfile_2019_10_15.log, I have to use a monitor stanza like this:

[monitor:///tmp/my_logs/myfile_*.log]

Ciao.
Giuseppe