Using the Unix App, monitoring Radius log files. /var/log/radius/radius.log Current log file gets renamed and gzipped. Splunk is indexing radius.log but also indexing radius.log-20101105 and radius.log-20101105.gz.
Suggestions? Thanks.
That worked but only for the radius.log file. Modified the blacklist value to include a more generic form that also covered other log files in /var/log/ with the same naming convention (filename.log-<somedate>[.gz|.bz2]
)
_blacklist=(lastlog|(.log-\d{8}.*)$)
Used the command 'splunk list monitor | grep filename' to confirm the dated files were no longer being monitored, which seems to be the best way to test that the syntax is correct. Thanks for the help!
Try blacklisting the rolled/gzipped logs:
$SPLUNK_HOME/etc/apps/unix/local/inputs.conf:
[monitor:///var/log]
disabled = 0
_blacklist = (lastlog|radius\.log.+)