Getting Data In

Log roation to a certain extenstion and starts at first log

mohankesireddy
Path Finder

We have a log rotation in place which writes logs to files names access.log.001 to access.log.005 and start back writing to access.log.001. how to monitor such logs with out affecting the performance as we have hundreds of such servers.

does using the follow-tail is the best option.

Tags (2)
0 Karma

Ayn
Legend
0 Karma

mohankesireddy
Path Finder

Thanks Ayn and MUS for your answers, thanks for clarifying me on followtail. my main concern here is will it be a performance issues when it moniots all the files, while only one file is being actively written. Is there a way to let splunk know only monitor only the active file. will crcsalt resolve my issue.
As I already mentioned, I have thousands of these files to be monitored, so I am concerned about the performance.

0 Karma

MuS
SplunkTrust
SplunkTrust

in addition to Ayn answer: followTail=1 will only tell splunk at the very first start, not to eat up data before splunk's startup time in the current log file, but to read everything after startup time. read more here: http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Inputsconf

cheers,
MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...