Getting Data In

Tomcat 7.0 Logs on Windows Server 2012 R2

martineisenkoel
New Member

Hi,

I'm pretty new to using the universal forwarder on Windows Servers.
Our indexer Server is running on 7.2.0 and the used Forwarders version is 7.2.1.

I've added a straight forward monitor (pls see inputs.onf below) to the Tomcat log dir but indexing these events get interrputed daily between 10pm and 12pm.
Thats the time when the tomcat log files are getting rotated. Suprisingly for myself splunks knows about the newly created file but didnt start to index until I restart the Forwarder service.

Since Windows isnt changing the mod/creation/access dates I guessed that the Forwarder simply doesnt knows about a change to the file and tried - alwaysOpenFile=1 - but without success, same behaviour.

Perfmon and several other logs form the server are index correctly and contionously.

Please also see config files below.
Many thanks in advance!

Regards,
Martin

Inputs.conf of the app

[default]
ignoreOlderThan = 7d

[monitor://D:\Program Files\Apache Software Foundation\Tomcat7.0\logs\*]
alwaysOpenFile=1
disabled = false


[monitor://D:\Program Files\BMC Software\ARSystem\midtier\logs\*]
alwaysOpenFile=1
disabled = false
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@martineisenkoelbl ,

While the log rotation happens , normally it rotates the old log, compresses/archives and creates a new file with the same name. But since Splunk still has the file handler opens to the old log file during the time of rotation, it still looks at the old file for new entries.

Unless you restart Splunk, it does not now about the new file. So either you need to restart splunk or change the log rotation mechanism to keep the original file by moving the old content to a different file.

Happy Splunking!
0 Karma

martineisenkoel
New Member

the newly created log file is named with the actual date so names are always uniqe.
Thats the std. tomcat accesslog mechanism I think.

D:\\Program Files\\Apache Software Foundation\\Tomcat7.0\\logs\\localhost_access_log.2018-11-28.txt

Also splunks lists the new file as source in web search but theres no log entry indexed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...