Splunk Enterprise

Is it possible to change rotation timing for the internal logs on daily basis?

super_saiyan
Communicator

is it possible to change the log rotation timing for the internal logs that Universal Forwarder and Heavy Forwarder output to the OS.

For example, splunkd.log. Currently, the logs are rotated by file size, but can we rotate on a daily basis.

is it possible ?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

The appender parameters are size-based. You'd have to try and see if the DailyRollingFileAppender is available instead and reconfigure whole logging framework for the other appender.

super_saiyan
Communicator

Thank you for your quick response. could you please share some insights regarding "DailyRollingFileAppender" ?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

To be fully honest, I'm just guessing since the configuration looks like log4j but as far as I know splunk itself doesn't use java so there must be simply some similar framework. (and there are many very similar framework for other programming languages/environments)

With log4j you have whole framework where on the one side you define logging categories and all the stuff responsible for ingesting the logged events and on the other side you define output channels (kinda like in splunk itself ;-)) - appenders. They append entries to some "storage channel" - files, network sockets for sending over to external server, console and so on.

As I can see in the log.cfg in default splunk installation, it uses an appender called RollingFileAppender. This one as you can see here https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/RollingFileAppender.html (again - it's a log4j doc whereas splunk uses something different but similar) the options here only govern file size and maximum number of backlog files. But if you configure a DailyRollingFileAppender - https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/DailyRollingFileAppender.html - you can configure other parameters pertaining to time-based rotation.

But.

1) I don't know if this appender is implemented in the library splunk uses

2) time-based rotation makes it possible for splunk to fill up the disk in case of a very "talkative" splunk operation (like some bug or something).

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...