Getting Data In

Record snmptrap log file to other and clear the original log file

sony_1688
New Member

Hello, my problem is that I want to use splunk to copy the log from snmptrapd.log file to another file and clear the original snmptrapd periodically. It is because when there is large amount of log. The size of snmptrapd.log file can not handle the large amount log.

Thank you for your help

Tags (1)
0 Karma

Paolo_Prigione
Builder

I guess this is a problem of log rotation.

You could create a script which deletes the file after it has grown too large:

#!/bin/bash
find /var/run/ -name snmptrapd* -size +10M -delete

and schedule this script either with cron or Splunk scripted inputs. Instead of deleting, you could execute some other action, like making a zip file or moving the file somewhere else.

Point Splunk's monitor stanza to the exact file name (e.g. [monitor:///var/run/snmptrapd.log]) and you should not have any problem of duplicate entries.

Hope this helps

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...