Getting Data In

managing log.cfg through deployment server

dstaulcu
Builder

I am trying to minimize noise level (across WAN) by splunk to greatest degree possible..

With review of index=_internal source=splunkd, I see that each of my universal forwarders is forwarding lines from splunkd.log. This log file is very noisy with most components logging INFO level events by default. I want to change most of the logging levels to >= WARN.

I know this can be done by manually altering logging levels in .\etc\log.cfg. Does anyone have any experience managing this configuration as a deployment-app? I imagine it would be possible with deployment of a script to execute line changes.. Is this a bad idea?

inputs appreciated.

0 Karma
1 Solution

dstaulcu
Builder

Here is how I plan to package that solution as an app:

Create a new app with following files:

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.bat

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.vbs

.\deployment-apps\UF-LogCfgMgr\local\inputs.conf

12/28/2013 - Follow up. Method worked. Added condition to leave INFO logging levels to DEV/TEST deployment clients but to use WARN only for PROD deployment clients.

1/19/2013 - updated logcfg.vbs to use log-local.cfg construct, to further tweak logging levels, to, and to support x86 on x64. Supports windows only

View solution in original post

dstaulcu
Builder

Here is how I plan to package that solution as an app:

Create a new app with following files:

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.bat

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.vbs

.\deployment-apps\UF-LogCfgMgr\local\inputs.conf

12/28/2013 - Follow up. Method worked. Added condition to leave INFO logging levels to DEV/TEST deployment clients but to use WARN only for PROD deployment clients.

1/19/2013 - updated logcfg.vbs to use log-local.cfg construct, to further tweak logging levels, to, and to support x86 on x64. Supports windows only

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...