Splunk Enterprise

Does splunk 6.x support DailyRollingFileAppender?

erickyi
Path Finder

I tried to setup $SPLUNK_HOME/etc/log.cfg to change its current logging (RollingFileAppender)

Attempt 1 - failed : encountered parsing errors
appender.A4=org.apache.log4j.DailyRollingFileAppender
appender.A1.File=${SPLUNK_HOME}/var/log/splunk/splunkd.log
appender.A1.DatePattern='.'yyyy-MM-dd

Attempt 2 - failed due to parsing errors
appender.A1=RollingFileAppender
appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log
appender.A1.filePattern=${SPLUNK_HOME}/var/log/splunk/splunkd.log-%d{yyyy-MM-dd}-%i

Help. what can i do to change the logging? I thought splunk supports the standard log4j 2

Tags (2)
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

The short answer is that any appender other than the RollingFileAppender won't work.
While the configuration file suggests log4j use under the covers, that is not the case. The implementation was changed to remove a dependency on a 3rd-party library, but the cfg file structure was preserved.
The only supported file appender in the current implementation is the RollingFileAppender.

The only option is to rotate files outside of Splunk and hope that we can handle renaming an active log file transparently... 😉

View solution in original post

erickyi
Path Finder

Thanks ssievert for the quick response and letting us know. Cheers 🙂

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The short answer is that any appender other than the RollingFileAppender won't work.
While the configuration file suggests log4j use under the covers, that is not the case. The implementation was changed to remove a dependency on a 3rd-party library, but the cfg file structure was preserved.
The only supported file appender in the current implementation is the RollingFileAppender.

The only option is to rotate files outside of Splunk and hope that we can handle renaming an active log file transparently... 😉

s2_splunk
Splunk Employee
Splunk Employee

Just to verify: In your first attempt, did you really use appender.A4=org.apache.... instead of appender.A1=org.apache....?

0 Karma

erickyi
Path Finder

HI ssievert,

Yes, I tried both options ; org.apache.log4j.DailyRollingFileAppender and DailyRollingFileAppender
but unfortunately both failed

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I just tried and getting Parse error at "appender.A1.DatePattern='.'yyyy-MM-dd" as well. I'll see what I can find out...

0 Karma

erickyi
Path Finder

Thank you ssievert,

good that you confirmed my findings.

My objective is that if I have a daily rolling mechanism going, then it would be easy for me to backup the old logs incrementally (by date). If this is not possible, then I will use native unix technologies. i am getting there on my script.

Test: find $SPLUNK_HOME -name '*.log.?' -exec stat --printf="%y %n\n" {} \;|grep date +"%Y-%m-%d" |awk '{print $4}'

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...