Looking at the set-up here and it looks good -
-rw-------. 1 splnkfwd splnkfwd 24M Feb 4 07:57 metrics.log.5
-rw-------. 1 splnkfwd splnkfwd 24M Feb 5 18:41 metrics.log.4
-rw-------. 1 splnkfwd splnkfwd 24M Feb 7 05:35 metrics.log.3
-rw-------. 1 splnkfwd splnkfwd 24M Feb 8 16:24 metrics.log.2
-rw-------. 1 splnkfwd splnkfwd 24M Feb 10 03:13 metrics.log.1
-rw-------. 1 splnkfwd splnkfwd 21M Feb 11 08:55 metrics.log
-rw-------. 1 splnkfwd splnkfwd 9.3M Feb 11 08:55 splunkd.log
$ grep metric log.cfg
metrics spews a lot of logs, let's not pollute the other files.
appender.metrics=RollingFileAppender
appender.metrics.fileName=${SPLUNK_HOME}/var/log/splunk/metrics.log
appender.metrics.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.metrics.maxBackupIndex=5
appender.metrics.layout=PatternLayout
appender.metrics.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.Metrics=INFO,metrics
category.StatusMgr=INFO,metrics
... View more