Monitoring Splunk

Any reason why Btool might be continuously logging in DEBUG mode?

hagjos43
Contributor

One of my windows indexers is constantly writing to the btool log in DEBUG mode. I didn't build this environment, but I now manage it. Any reason why this would happen? I'm assuming it's something someone turned on in the past and never turned off. How do I go about disabling this?

Thanks

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi hagjos43,

Either check in the UI Server settings » Server logging the btool-support log channel or on the file system of the server goto $SPLUNK_HOME/etc/ and check the settings in log-btool.cfg or log-local.cfg related to btool.
Don forget to restart Splunk after any logging changes.

Hope this helps ...

cheers, MuS

hagjos43
Contributor

Thanks for the response!

I couldn't post an imagine in the comment section so please see my "Answer" below".

0 Karma

hagjos43
Contributor

so I have a log-btool-debug.cfg listed. Is that why this would be enabled? There is a few -debug files listed (see image).
alt text

0 Karma

MuS
SplunkTrust
SplunkTrust

Those are the default .cfg files, you have to check if either the btool log channel is set to debug or if for what ever reason Splunk is started in debug mode - see the docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Troubleshooting/Enabledebuglogging

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...