Getting Data In

Splunk DB Connect: Why Web Access data is being logged into jbridge.log?

musskopf
Builder

Hello,

I noticed today that Web Access data is being logged inside the DB Connect Logfile $SPLUNK_HOME/var/log/splunk/jbridge.log. Apparently the Splunk Web server is logging the access to both files: jbridge.log and web_access.log. Is anybody experiencing the same?

If I run lsof jbridge.log I get:

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
splunkd 5307 splunk   92u   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    3w   REG  253,2  7836435 138393 jbridge.log
python  5363 splunk    4w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    3w   REG  253,2  7836435 138393 jbridge.log
java    5366 splunk    4w   REG  253,2  7836435 138393 jbridge.log
python  5424 splunk    6w   REG  253,2  7836435 138393 jbridge.log

Where the PID 6363 is python /apps/splunk/etc/apps/dbx/bin/jbridge_server.py and PID 5424 is python -O /apps/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart

Looks like the Webserver is sending the messages to both handlers.

Here my Software Versions:
RedHat EL 6.5
Splunk 6.1.1
Splunk DB Connect 1.1.4

Any help is appreciated!

Cheers,
Mike M.

1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

View solution in original post

mchang_splunk
Splunk Employee
Splunk Employee

Hi Musskopf,

These 2 issues have been fixed in DB connect 1.1.5.
Please upgrade to get them fixed.

By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files.
To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local
Please refer to
http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings

Hope this helps.

mthierbel
Explorer

Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page.
http://docs.splunk.com/Documentation/DBX/1.1.5/ReleaseNotes/Releasenotes

0 Karma

shaun_dyble
Explorer

Im having the same issue .. web logs are being inserted into the jbridge.log (DB Connect 1.1.4).

0 Karma

jfarmiloe
Explorer

Upgrading to DBX 1.1.5 fixed this issue for me.

jdbtee
Path Finder

I have a similar issue, it is currently running @ 1GB

I cannot find any jbridge.conf

0 Karma

musskopf
Builder

I don't think there is a jbridge.conf... and the jbridge_server.conf is not there by default, need to be created at $SPLUNK_HOME/etc/apps/dbx/local

0 Karma

musskopf
Builder

forgot to mention, the logfile also doesn't rotate. Here my jbridge_server.conf:

[log]
filename=jbridge.log
maxCount=3
fileSize=15000000
logLevel=info

It should rotate at 15Mb but my logfile keeps growing up to 1Gb and I need to remove/rotate manually.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...