Getting Data In

Record snmptrap log file to other and clear the original log file

sony_1688
New Member

Hello, my problem is that I want to use splunk to copy the log from snmptrapd.log file to another file and clear the original snmptrapd periodically. It is because when there is large amount of log. The size of snmptrapd.log file can not handle the large amount log.

Thank you for your help

Tags (1)
0 Karma

Paolo_Prigione
Builder

I guess this is a problem of log rotation.

You could create a script which deletes the file after it has grown too large:

#!/bin/bash
find /var/run/ -name snmptrapd* -size +10M -delete

and schedule this script either with cron or Splunk scripted inputs. Instead of deleting, you could execute some other action, like making a zip file or moving the file somewhere else.

Point Splunk's monitor stanza to the exact file name (e.g. [monitor:///var/run/snmptrapd.log]) and you should not have any problem of duplicate entries.

Hope this helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...