Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

[musskopf]

Hello,

I noticed today that Web Access data is being logged inside the DB Connect Logfile $SPLUNK_HOME/var/log/splunk/jbridge.log. Apparently the Splunk Web server is logging the access to both files: jbridge.log and web_access.log. Is anybody experiencing the same?

If I run lsof jbridge.log I get:

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
splunkd 5307 splunk   92u   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    3w   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    4w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    3w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    4w   REG  253,2  7836435 138393 jbridge.log
python  5424 splunk    6w   REG  253,2  7836435 138393 jbridge.log

Where the PID 6363 is python /apps/splunk/etc/apps/dbx/bin/jbridge_server.py and PID 5424 is python -O /apps/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart

Looks like the Webserver is sending the messages to both handlers.

Here my Software Versions:
RedHat EL 6.5
Splunk 6.1.1
Splunk DB Connect 1.1.4

Any help is appreciated!

Cheers,
Mike M.

[mchang_splunk · Accepted solution]

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

[mthierbel]

Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page.
http://docs.splunk.com/Documentation/DBX/1.1.5/ReleaseNotes/Releasenotes

[shaun_dyble]

Im having the same issue .. web logs are being inserted into the jbridge.log (DB Connect 1.1.4).

[jfarmiloe]

Upgrading to DBX 1.1.5 fixed this issue for me.

[jdbtee]

I have a similar issue, it is currently running @ 1GB

I cannot find any jbridge.conf

[musskopf]

I don't think there is a jbridge.conf... and the jbridge_server.conf is not there by default, need to be created at $SPLUNK_HOME/etc/apps/dbx/local

[musskopf]

forgot to mention, the logfile also doesn't rotate. Here my jbridge_server.conf:

[log]

filename=jbridge.log

maxCount=3

fileSize=15000000

logLevel=info

It should rotate at 15Mb but my logfile keeps growing up to 1Gb and I need to remove/rotate manually.