Monitoring Splunk

How can I control the size and number of Splunk's internal logs?

Mick
Splunk Employee
Splunk Employee

Some of our servers are running low on Disk capacity and we are concerned with splunk log files generated and stored on these boxes. The logfiles metrics.log.1 (2,3,4,5) are all 24.5 MB each. This causes the Spunk agent logs to eat up more 100MB in disk space.

Is there a way to limit the log files to just one and control the amount it can grow? If we can keep this log to 24MB in total that would be great.

Tags (1)
1 Solution

oreoshake
Communicator

$SPLUNK_HOME/etc/log.cfg

appender.metrics.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.metrics.maxBackupIndex=1

I usually cut the maxfilesize down to 5mb. You'll want to apply this to at least the splunkd.log as well

appender.A1.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.A1.maxBackupIndex=1

As mentioned in the doc, you should create a log-local.cfg so your settings don't get erased

View solution in original post

oreoshake
Communicator

$SPLUNK_HOME/etc/log.cfg

appender.metrics.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.metrics.maxBackupIndex=1

I usually cut the maxfilesize down to 5mb. You'll want to apply this to at least the splunkd.log as well

appender.A1.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.A1.maxBackupIndex=1

As mentioned in the doc, you should create a log-local.cfg so your settings don't get erased

Mick
Splunk Employee
Splunk Employee

Yes, this can be configured in $SPLUNK_HOME/etc/log.cfg and is documented at http://docs.splunk.com/Documentation/Splunk/5.0/Troubleshooting/WhatSplunklogsaboutitself

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...