2

The current log file name I have is: catalina.2010-02-24.log.

I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames the log file.

[tail:///var/logs/catalina.2010-02-24.log] is not gonna work. Is there a way around this problem

2 Answers 2

2

You can index either the whole directory, or use wildcards to select the appropriate files.

In your case, [monitor://var/logs/catalina.*.log] should work correctly.

0

You could add a script that runs as a daily cron job which symlinks the file based on the date to catalina.current.log or something such as this.

Example:

ln -sf /var/logs/catalina.`date +%Y-%m-%d`.log /var/logs/catalina.current.log

Then of course just use catalina.current.log to access the current day's log.

2
  • Disclaimer: I know nothing about Splunk, so this may cause problems. Feb 24, 2010 at 22:49
  • You could also index /var/logs/catalina.*.log I believe. Or put the logs in /var/logs/catalina and monitor this directory. Feb 24, 2010 at 22:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .