maxBackupIndex for logs other than splunkd not working

[rgcox1]

I am trying to minimize light forwarder footprint using maxBackupIndex as described in other posts here and in the documentation. It works for the splunkd log files, but not for metrics or audit logs.

appender.A1.maxBackupIndex=1
appender.metrics.maxBackupIndex=1
appender.audittrail.maxBackupIndex=1

It limits the splunkd backup copies when placed in log-local.cfg and deployed from the server, but not the other logs. Even adding this to the log-local in the splunk\etc folder, or editing log.cfg directly has no effect on the number of backup copies for metrics and audit.

Thanks.

[yannK]

@Lowell is right,

I confirm the log.cfg has to be in he $SPLUNK_HOME/etc/
therefore cannot be deployed from a deployment server (that only push apps to $SPLUNK_HOME/etc/apps/)

[Lowell]

I'm pretty sure this file has to be directly in the etc folder and NOT under any apps folder. Therefore I don't think you can easily deploy this setting to all of your forwarders without some tricks.

[yannK]

I confirm the log.cfg has to be in he $SPLUNK_HOME/etc/,
therefore cannot be deployed from a deployment server (that only push apps to $SPLUNK_HOME/etc/apps/)

[rgcox1]

By "deployed from the server" I just mean that it's a deployment client, and the conf file does not exist in system\local, but in the deployed app folder (C:\Program Files\splunk\etc\apps\win_all\local in this case). maxBackupIndex does not occur in splunkd.log.

[jrodman]

I'm not sure what you mean by "deployed from the server". I'm surprised that changing the values in log.cfg directly has no effect upon restart. You might check to see if there are any warnings about setting not being honored. In the code, maxBackupIndex defaults to zero, so I suspect this is an environment problem.