Getting Data In

syslog files growing out of control.

craigrussell
New Member

How do I deal with large syslog files that keep growing?
Do I just delete them or is there an automated way of rolling them. I don't want to lose the data or disconnect the hosts sending it.

Tags (1)
0 Karma

borisalves
Path Finder
0 Karma

jonuwz
Influencer

sowings
Splunk Employee
Splunk Employee

Note that in the Splunk context, you probably want the "delaycompress" option, so that rotated log files can be correctly identified, and read to the end of the file even after the file has been rotated.

craigrussell
New Member

Thanks for the tip. I'll try it.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.