Hi,
I need to provide the rollover policy for the python log file present in the /opt/splunk/var/log/splunk directory. I tried adding the following stanza in log.cfg:
[python]
splunk = INFO
splunk.appserver = INFO
splunk.appserver.controllers = INFO
splunk.appserver.lib = WARN
appender.python=RollingFileAppender
appender.python.fileName=${SPLUNK_HOME}/var/log/splunk/python.log
appender.python.maxFileSize=1000 # default: 25MB (specified in bytes).
appender.python.maxBackupIndex=20
appender.python.layout=PatternLayout
appender.python.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.PythonLogger=INFO,python
After these changes, I got the error:
2013-03-01 15:04:53,825 ERROR [5130763d33de8c610] root:544 - 'module' object has no attribute 'ROLLINGFILEAPPENDER'
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 96, in
splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME)
File "/opt/splunk/lib/python2.7/site-packages/splunk/init.py", line 146, in setupSplunkLogger
logging.getLogger(loggerName).setLevel(getattr(logging, level))
AttributeError: 'module' object has no attribute 'ROLLINGFILEAPPENDER'
I tried changing the category.PythonLogger=INFO,python to category.PythonLogger=INFO,A5 and also A2 but still I faced same issue. Can someone please help me with this.
As of today, Splunk does not be designed for Python log rotation since to support python log rotation some design level changes are required and that cannot be done in maintenance releases. If you force to configure it, SplunkWed won't start correctly once you restart Splunk instance. Also you will see following error in web_services.log.
2017-04-04 15:56:02,928 ERROR [58e34382a0701d2955c0] root:814 - 'module' object has no attribute '10'
Traceback (most recent call last):
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 90, in <module>
splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\__init__.py", line 154, in setupSplunkLogger
logging.getLogger(loggerName).setLevel(getattr(logging, level))
AttributeError: 'module' object has no attribute '10'
If you need this feature, you can open a new support case as an Enhancement Request.