Getting Data In

Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

musskopf
Builder

Hello,

I noticed today that Web Access data is being logged inside the DB Connect Logfile $SPLUNK_HOME/var/log/splunk/jbridge.log. Apparently the Splunk Web server is logging the access to both files: jbridge.log and web_access.log. Is anybody experiencing the same?

If I run lsof jbridge.log I get:

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
splunkd 5307 splunk   92u   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    3w   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    4w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    3w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    4w   REG  253,2  7836435 138393 jbridge.log
python  5424 splunk    6w   REG  253,2  7836435 138393 jbridge.log

Where the PID 6363 is python /apps/splunk/etc/apps/dbx/bin/jbridge_server.py and PID 5424 is python -O /apps/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart

Looks like the Webserver is sending the messages to both handlers.

Here my Software Versions:
RedHat EL 6.5
Splunk 6.1.1
Splunk DB Connect 1.1.4

Any help is appreciated!

Cheers,
Mike M.

1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

View solution in original post

mchang_splunk
Splunk Employee
Splunk Employee

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

mthierbel
Explorer

Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page.
http://docs.splunk.com/Documentation/DBX/1.1.5/ReleaseNotes/Releasenotes

0 Karma

shaun_dyble
Explorer

Im having the same issue .. web logs are being inserted into the jbridge.log (DB Connect 1.1.4).

0 Karma

jfarmiloe
Explorer

Upgrading to DBX 1.1.5 fixed this issue for me.

jdbtee
Path Finder

I have a similar issue, it is currently running @ 1GB

I cannot find any jbridge.conf

0 Karma

musskopf
Builder

I don't think there is a jbridge.conf... and the jbridge_server.conf is not there by default, need to be created at $SPLUNK_HOME/etc/apps/dbx/local

0 Karma

musskopf
Builder

forgot to mention, the logfile also doesn't rotate. Here my jbridge_server.conf:

[log]
filename=jbridge.log
maxCount=3
fileSize=15000000
logLevel=info

It should rotate at 15Mb but my logfile keeps growing up to 1Gb and I need to remove/rotate manually.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...