Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The current log file name I have is: catalina.2010-02-24.log.

I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames the log file.

[tail:///var/logs/catalina.2010-02-24.log] is not gonna work. Is there a way around this problem

share|improve this question
up vote 2 down vote accepted

You can index either the whole directory, or use wildcards to select the appropriate files.

In your case, [monitor://var/logs/catalina.*.log] should work correctly.

share|improve this answer

You could add a script that runs as a daily cron job which symlinks the file based on the date to catalina.current.log or something such as this.


ln -sf /var/logs/catalina.`date +%Y-%m-%d`.log /var/logs/catalina.current.log

Then of course just use catalina.current.log to access the current day's log.

share|improve this answer
Disclaimer: I know nothing about Splunk, so this may cause problems. – Michael Mior Feb 24 '10 at 22:49
You could also index /var/logs/catalina.*.log I believe. Or put the logs in /var/logs/catalina and monitor this directory. – Michael Mior Feb 24 '10 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.