Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The current log file name I have is: catalina.2010-02-24.log.

I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames the log file.

[tail:///var/logs/catalina.2010-02-24.log] is not gonna work. Is there a way around this problem

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You can index either the whole directory, or use wildcards to select the appropriate files.

In your case, [monitor://var/logs/catalina.*.log] should work correctly.

share|improve this answer

You could add a script that runs as a daily cron job which symlinks the file based on the date to catalina.current.log or something such as this.

Example:

ln -sf /var/logs/catalina.`date +%Y-%m-%d`.log /var/logs/catalina.current.log

Then of course just use catalina.current.log to access the current day's log.

share|improve this answer
    
Disclaimer: I know nothing about Splunk, so this may cause problems. –  Michael Mior Feb 24 '10 at 22:49
    
You could also index /var/logs/catalina.*.log I believe. Or put the logs in /var/logs/catalina and monitor this directory. –  Michael Mior Feb 24 '10 at 22:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.