How to increase the number of internal logs retained on local server

[coleman07]

I want to keep more than 5 copies of eventgen.log. The log file is located in /opt/splunk/var/log/splunk, but is not one of the standard log files. How do I configure Splunk to keep more copies of this file? It looks like $SPLUNK_HOME/etc/log.cfg has specific lines for each log file and I don't know what to add to this file to manage eventgen.log.

[Jeremiah]

I'm not sure that you can modify that setting in the log.cfg file. You can easily change it directly in the code though. In SA-Eventgen/lib/eventgenconfig.py, change the value of backupCount on line 402:

    fileHandler = logging.handlers.RotatingFileHandler(os.environ['SPLUNK_HOME'] + '/var/log/splunk/eventgen.log', maxBytes=25000000, backupCount=5)