Deployment Architecture

maxBackupIndex for logs other than splunkd not working

Communicator

I am trying to minimize light forwarder footprint using maxBackupIndex as described in other posts here and in the documentation. It works for the splunkd log files, but not for metrics or audit logs.

appender.A1.maxBackupIndex=1
appender.metrics.maxBackupIndex=1
appender.audittrail.maxBackupIndex=1

It limits the splunkd backup copies when placed in log-local.cfg and deployed from the server, but not the other logs. Even adding this to the log-local in the splunk\etc folder, or editing log.cfg directly has no effect on the number of backup copies for metrics and audit.

Thanks.

Splunk Employee
Splunk Employee

@Lowell is right,

I confirm the log.cfg has to be in he $SPLUNK_HOME/etc/
therefore cannot be deployed from a deployment server (that only push apps to $SPLUNK_HOME/etc/apps/)

0 Karma

Super Champion

I'm pretty sure this file has to be directly in the etc folder and NOT under any apps folder. Therefore I don't think you can easily deploy this setting to all of your forwarders without some tricks.

0 Karma

Splunk Employee
Splunk Employee

I confirm the log.cfg has to be in he $SPLUNK_HOME/etc/,
therefore cannot be deployed from a deployment server (that only push apps to $SPLUNK_HOME/etc/apps/)

0 Karma

Communicator

By "deployed from the server" I just mean that it's a deployment client, and the conf file does not exist in system\local, but in the deployed app folder (C:\Program Files\splunk\etc\apps\win_all\local in this case). maxBackupIndex does not occur in splunkd.log.

0 Karma

Splunk Employee
Splunk Employee

I'm not sure what you mean by "deployed from the server". I'm surprised that changing the values in log.cfg directly has no effect upon restart. You might check to see if there are any warnings about setting not being honored. In the code, maxBackupIndex defaults to zero, so I suspect this is an environment problem.

0 Karma