Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

[ftk]

Is it possible to deploy $SPLUNK_HOME/etc/log.cfg via the deployment server to my forwarders? I wish to reduce the footprint of my Lightweight Forwarders by reducing the log sizes as mentioned here: http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

I am currently handling this at initial Splunk installation time, however would prefer to offload this on to the Splunk deployment server.

[dstaulcu]

Details on how I overcame this in another thread:

http://answers.splunk.com/answers/115363/managing-logcfg-through-deployment-server

[dcparker]

did you ever get this solved?

[Jason]

You could hack up deployment server to deploy to etc, but it only deploys "apps" and you probably wouldn't be able to deploy the exact file etc/log.cfg. Perhaps etc/something/local/log.cfg, but then Splunk wouldn't pick it up.

You could try symlinking etc/log.cfg to somewhere inside an app in etc/apps, then deploy that with DS, making sure to restart Splunk upon app install. That might work, but you would have to manage the symlink somehow.

[jrodman · Accepted solution]

Deployment server doesn't really do this, and the logging framework has to work before the bundle code starts up. I mean sure some chicken-and-egg engineering could be done with a bootstrap mode and a later runtime mode, but it's not a high payoff area compared to some others right now.

please do hit up support email with an Enhancement Request about that this matters to you folks. It gets raised now and then but I don't know if it gets through to product management.