Record snmptrap log file to other and clear the original log file

[sony_1688]

Hello, my problem is that I want to use splunk to copy the log from snmptrapd.log file to another file and clear the original snmptrapd periodically. It is because when there is large amount of log. The size of snmptrapd.log file can not handle the large amount log.

Thank you for your help

[Paolo_Prigione]

I guess this is a problem of log rotation.

You could create a script which deletes the file after it has grown too large:

#!/bin/bash
find /var/run/ -name snmptrapd* -size +10M -delete

and schedule this script either with cron or Splunk scripted inputs. Instead of deleting, you could execute some other action, like making a zip file or moving the file somewhere else.

Point Splunk's monitor stanza to the exact file name (e.g. [monitor:///var/run/snmptrapd.log]) and you should not have any problem of duplicate entries.

Hope this helps