how to disable the data for metrics.log ??

[rakesh_498115]

Hi..

How can i disable / restrict the data to the metrics.log at forwarder level...can anyone pls help.
i have changed the sizes in log.cfg file but then i could the metrics data..

### appender.A3.fileName=${SPLUNK_HOME}/var/log/splunk/splunklogger.log
###
appender.license_usage=RollingFileAppender
appender.license_usage.fileName=${SPLUNK_HOME}/var/log/splunk/license_usage.log
appender.license_usage.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.license_usage.maxBackupIndex=1
appender.license_usage.layout=PatternLayout
appender.license_usage.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.LicenseUsage=INFO,license_usage
appender.A4=RollingFileAppender
appender.A4.fileName=${SPLUNK_HOME}/var/log/splunk/searchhistory.log
appender.A4.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.A4.maxBackupIndex=1
appender.A4.layout=PatternLayout
appender.A4.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.SearchHistory=INFO, A4
# metrics spews a lot of logs, let's not pollute the other files.
appender.metrics=RollingFileAppender
appender.metrics.fileName=${SPLUNK_HOME}/var/log/splunk/metrics.log
appender.metrics.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.metrics.maxBackupIndex=1
appender.metrics.layout=PatternLayout
appender.metrics.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.Metrics=INFO,metrics
category.StatusMgr=INFO,metrics
category.DeploymentMetrics=INFO,metrics
# audit logs go a separate file
appender.audittrail=RollingFileAppender
appender.audittrail.fileName=${SPLUNK_HOME}/var/log/splunk/audit.log
appender.audittrail.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.audittrail.maxBackupIndex=1
appender.audittrail.layout=PatternLayout
appender.audittrail.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.AuditLogger=INFO,audittrail
#Licence Audit
appender.licenseaudit=RollingFileAppender
appender.licenseaudit.fileName=${SPLUNK_HOME}/var/log/splunk/license_audit.log
appender.licenseaudit.layout=PatternLayout
appender.licenseaudit.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l} %-5p %c - %m%n
category.LicenseManager-Audit=INFO,licenseaudit
#splunkd http server acccess log
appender.accesslog=RollingFileAppender
appender.accesslog.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd_access.log
appender.accesslog.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.accesslog.maxBackupIndex=1
appender.accesslog.layout=PatternLayout
appender.accesslog.layout.ConversionPattern=%m%n
category.HTTPAccess=INFO,accesslog
#splunkd search scheduler log
appender.scheduler=RollingFileAppender
appender.scheduler.fileName=${SPLUNK_HOME}/var/log/splunk/scheduler.log
appender.scheduler.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.scheduler.maxBackupIndex=1
appender.scheduler.layout=PatternLayout
appender.scheduler.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.SavedSplunker=INFO,scheduler
#
# define splunk python logging properties

[dart]

Have you seen this question about splunks internal log sizes?

Does it resolve your issue?

[rakesh_498115]

hi dart .. can you pls help here..i have posted my log.cfg file

[dart]

Can you post your log.cfg?

[rakesh_498115]

yeah dart..i have seen this info and updated the log.cfg file of both the forwader servers...but even then the metrics size from the forwarder for a day is showing as 2 GB .. :(...can you pls help here..wats wrong..