All Apps and Add-ons

SA-Eventgen how to decrease log verbosity

gballanti
Explorer

I've installed SA-Eventgen and SPL Examples that work as expected. Unfortunately in few days the logs filled up my filesystem. In particulary the "/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/logs/eventgen-main.log" file is becomed 22G big in a week.
The log reports rows as follow

2019-12-18 09:15:09 eventgen DEBUG MainProcess {'event': "hourOfDayRate for sample 'noise.cpu' in app 'spl_examples' is 0.4"}
2019-12-18 09:15:09 eventgen DEBUG MainProcess {'event': "dayOfWeekRate for sample 'noise.cpu' in app 'spl_examples' is 0.5"}
2019-12-18 09:15:09 eventgen DEBUG MainProcess {'event': 'Original count: 7.5 Rated count: 2 Rate factor: 0.2038'}

So I was thinking that application could be in debug mode, checking the eventgen.conf seems it ain't

debug = false
verbosity = false

Is there any way to reduce the log verbosity ?

Thanks & regards

1 Solution

lwu_splunk
Splunk Employee
Splunk Employee
  1. Try to set DEFAULT_LOGGING_LEVEL = "ERROR" in $SPLUNK_HOME/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/logging_config/__init__.py; or
  2. Set 'disable_existing_loggers': True in $SPLUNK_HOME/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/logging_config/__init__.py;

View solution in original post

lwu_splunk
Splunk Employee
Splunk Employee
  1. Try to set DEFAULT_LOGGING_LEVEL = "ERROR" in $SPLUNK_HOME/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/logging_config/__init__.py; or
  2. Set 'disable_existing_loggers': True in $SPLUNK_HOME/etc/apps/SA-Eventgen/lib/splunk_eventgen/lib/logging_config/__init__.py;

gballanti
Explorer

option 1 works fine, thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...