I am trying to minimize light forwarder footprint using maxBackupIndex as described in other posts here and in the documentation. It works for the splunkd log files, but not for metrics or audit logs.
appender.A1.maxBackupIndex=1 appender.metrics.maxBackupIndex=1 appender.audittrail.maxBackupIndex=1
It limits the splunkd backup copies when placed in log-local.cfg and deployed from the server, but not the other logs. Even adding this to the log-local in the splunk\etc folder, or editing log.cfg directly has no effect on the number of backup copies for metrics and audit.
I'm pretty sure this file has to be directly in the
etc folder and NOT under any
apps folder. Therefore I don't think you can easily deploy this setting to all of your forwarders without some tricks.
By "deployed from the server" I just mean that it's a deployment client, and the conf file does not exist in system\local, but in the deployed app folder (C:\Program Files\splunk\etc\apps\win_all\local in this case). maxBackupIndex does not occur in splunkd.log.
I'm not sure what you mean by "deployed from the server". I'm surprised that changing the values in log.cfg directly has no effect upon restart. You might check to see if there are any warnings about setting not being honored. In the code, maxBackupIndex defaults to zero, so I suspect this is an environment problem.