Getting Data In

managing log.cfg through deployment server

dstaulcu
Builder

I am trying to minimize noise level (across WAN) by splunk to greatest degree possible..

With review of index=_internal source=splunkd, I see that each of my universal forwarders is forwarding lines from splunkd.log. This log file is very noisy with most components logging INFO level events by default. I want to change most of the logging levels to >= WARN.

I know this can be done by manually altering logging levels in .\etc\log.cfg. Does anyone have any experience managing this configuration as a deployment-app? I imagine it would be possible with deployment of a script to execute line changes.. Is this a bad idea?

inputs appreciated.

0 Karma
1 Solution

dstaulcu
Builder

Here is how I plan to package that solution as an app:

Create a new app with following files:

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.bat

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.vbs

.\deployment-apps\UF-LogCfgMgr\local\inputs.conf

12/28/2013 - Follow up. Method worked. Added condition to leave INFO logging levels to DEV/TEST deployment clients but to use WARN only for PROD deployment clients.

1/19/2013 - updated logcfg.vbs to use log-local.cfg construct, to further tweak logging levels, to, and to support x86 on x64. Supports windows only

View solution in original post

dstaulcu
Builder

Here is how I plan to package that solution as an app:

Create a new app with following files:

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.bat

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.vbs

.\deployment-apps\UF-LogCfgMgr\local\inputs.conf

12/28/2013 - Follow up. Method worked. Added condition to leave INFO logging levels to DEV/TEST deployment clients but to use WARN only for PROD deployment clients.

1/19/2013 - updated logcfg.vbs to use log-local.cfg construct, to further tweak logging levels, to, and to support x86 on x64. Supports windows only

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.