Archive

Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

Builder

Hello,

I noticed today that Web Access data is being logged inside the DB Connect Logfile $SPLUNK_HOME/var/log/splunk/jbridge.log. Apparently the Splunk Web server is logging the access to both files: jbridge.log and web_access.log. Is anybody experiencing the same?

If I run lsof jbridge.log I get:

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
splunkd 5307 splunk   92u   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    3w   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    4w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    3w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    4w   REG  253,2  7836435 138393 jbridge.log
python  5424 splunk    6w   REG  253,2  7836435 138393 jbridge.log

Where the PID 6363 is python /apps/splunk/etc/apps/dbx/bin/jbridge_server.py and PID 5424 is python -O /apps/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart

Looks like the Webserver is sending the messages to both handlers.

Here my Software Versions:
RedHat EL 6.5
Splunk 6.1.1
Splunk DB Connect 1.1.4

Any help is appreciated!

Cheers,
Mike M.

1 Solution

Splunk Employee
Splunk Employee

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

View solution in original post

Splunk Employee
Splunk Employee

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

View solution in original post

Explorer

Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page.
http://docs.splunk.com/Documentation/DBX/1.1.5/ReleaseNotes/Releasenotes

0 Karma

Explorer

Im having the same issue .. web logs are being inserted into the jbridge.log (DB Connect 1.1.4).

0 Karma

Explorer

Upgrading to DBX 1.1.5 fixed this issue for me.

Path Finder

I have a similar issue, it is currently running @ 1GB

I cannot find any jbridge.conf

0 Karma

Builder

I don't think there is a jbridge.conf... and the jbridge_server.conf is not there by default, need to be created at $SPLUNK_HOME/etc/apps/dbx/local

0 Karma

Builder

forgot to mention, the logfile also doesn't rotate. Here my jbridge_server.conf:

[log]
filename=jbridge.log
maxCount=3
fileSize=15000000
logLevel=info

It should rotate at 15Mb but my logfile keeps growing up to 1Gb and I need to remove/rotate manually.

0 Karma