Enabling python log rollover in splunk

[keerthana_k]

Hi,

I need to provide the rollover policy for the python log file present in the /opt/splunk/var/log/splunk directory. I tried adding the following stanza in log.cfg:

[python]

splunk = INFO

splunk.appserver = INFO

splunk.appserver.controllers = INFO

splunk.appserver.lib = WARN

appender.python=RollingFileAppender

appender.python.fileName=${SPLUNK_HOME}/var/log/splunk/python.log

appender.python.maxFileSize=1000 # default: 25MB (specified in bytes).

appender.python.maxBackupIndex=20

appender.python.layout=PatternLayout

appender.python.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n

category.PythonLogger=INFO,python

After these changes, I got the error:

2013-03-01 15:04:53,825 ERROR [5130763d33de8c610] root:544 - 'module' object has no attribute 'ROLLINGFILEAPPENDER'
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 96, in
splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME)
File "/opt/splunk/lib/python2.7/site-packages/splunk/init.py", line 146, in setupSplunkLogger
logging.getLogger(loggerName).setLevel(getattr(logging, level))
AttributeError: 'module' object has no attribute 'ROLLINGFILEAPPENDER'

I tried changing the category.PythonLogger=INFO,python to category.PythonLogger=INFO,A5 and also A2 but still I faced same issue. Can someone please help me with this.

[CurryPan]

As of today, Splunk does not be designed for Python log rotation since to support python log rotation some design level changes are required and that cannot be done in maintenance releases. If you force to configure it, SplunkWed won't start correctly once you restart Splunk instance. Also you will see following error in web_services.log.

2017-04-04 15:56:02,928 ERROR   [58e34382a0701d2955c0] root:814 - 'module' object has no attribute '10' 
Traceback (most recent call last): 
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 90, in <module> 
splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME) 
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\__init__.py", line 154, in setupSplunkLogger 
logging.getLogger(loggerName).setLevel(getattr(logging, level)) 
AttributeError: 'module' object has no attribute '10' 

If you need this feature, you can open a new support case as an Enhancement Request.

[dstoev]

According to your reply and https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself splunk does not mange python.log rotation, but then how it is being rotated? 

I've made python.log around 100MB with stopped splunk service and the python.log was NOT rotated. Once I've started splunk, log was immediately rotated to python.log.1, additionally the newly created python.log (size only few bites) I've also made it well over 25MB and it was rotated once again. 

[strive · Accepted solution]

http://dev.splunk.com/view/splunk-extensions/SP-CAAAEA9.

It works

[strive]

Hi Keerthana,

Try this

http://dev.splunk.com/view/splunk-extensions/SP-CAAAEA9