I noticed today that Web Access data is being logged inside the DB Connect Logfile
$SPLUNK_HOME/var/log/splunk/jbridge.log. Apparently the Splunk Web server is logging the access to both files:
web_access.log. Is anybody experiencing the same?
If I run
lsof jbridge.log I get:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME splunkd 5307 splunk 92u REG 253,2 7836435 138393 jbridge.log python 5363 splunk 3w REG 253,2 7836435 138393 jbridge.log python 5363 splunk 4w REG 253,2 7836435 138393 jbridge.log java 5366 splunk 3w REG 253,2 7836435 138393 jbridge.log java 5366 splunk 4w REG 253,2 7836435 138393 jbridge.log python 5424 splunk 6w REG 253,2 7836435 138393 jbridge.log
Where the PID 6363 is
python /apps/splunk/etc/apps/dbx/bin/jbridge_server.py and PID 5424 is
python -O /apps/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart
Looks like the Webserver is sending the messages to both handlers.
Here my Software Versions:
RedHat EL 6.5
Splunk DB Connect 1.1.4
Any help is appreciated!
forgot to mention, the logfile also doesn't rotate. Here my
I don't think there is a
jbridge.conf... and the
jbridge_server.conf is not there by default, need to be created at $SPLUNK_HOME/etc/apps/dbx/local
These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.
By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridgeserver.conf in $SPLUNKHOME/etc/apps/dbx/local
Please refer to
Hope this helps.
Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page.
Im having the same issue .. web logs are being inserted into the jbridge.log (DB Connect 1.1.4).