I installed the Splunk universal forwarder (agents) on several clients, running several days. # pwd /opt/splunkforwarder/etc # grep metric log.cfg # metrics spews a lot of logs, let's not pollute the other files. appender.metrics=RollingFileAppender appender.metrics.fileName=${SPLUNK_HOME}/var/log/splunk/metrics.log appender.metrics.maxFileSize=25000000 # default: 25MB (specified in bytes). appender.metrics.maxBackupIndex=5 appender.metrics.layout=PatternLayout appender.metrics.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n category.Metrics=INFO,metrics category.StatusMgr=INFO,metrics # ls -lctr |grep metric -rw-------. 1 root root 115789498 Sep 15 17:51 metrics.log.5 -rw-------. 1 root root 110047302 Sep 15 17:51 metrics.log.4 -rw-------. 1 root root 110284563 Sep 15 17:51 metrics.log.3 -rw-------. 1 root root 25926442 Sep 15 17:51 metrics.log.2 -rw-------. 1 root root 82850928 Sep 15 17:51 metrics.log.1 -rw-------. 1 root root 62256009 Sep 16 11:35 metrics.log Have the setting (max 25MB, and 5 backups), but the rotate log sizes are from 25MB ~ 110MB. Anything wrong and how can I fix it? I need the rotate log keep the size in 25MB each. ... View more