splunk / splunk/addonfactory-solutions-library-python

Log rotation is not functioning properly for multi-instance Splunk TAs.

Open
#420 4 comments 0 reactions 1 assignee View on GitHub

@artemrys is already working on this.

Since Jan 3, 2025.

Dominant language
Python
Stars
18
Forks
10
PR merge metrics
No merged PRs in 30d

Description

Description:
Log rotation is not functioning properly for multi-instance Splunk TAs.(This may be considered an ENHANCEMENT) and gets rotated multiple times and out-of-time by different inputs. I think this issue is happening since each input is a separate process in multi-instance mode while in single-instance the log instance is singleton between all threads (inputs). We've received some customer issues regarding the same.

Steps to reproduce:

  1. Create multiple TA inputs that support multi-instance configurations (e.g., TA with multi-instance options like Snow, Remedy, Box). Let the log file threshold to reach (25 MB by default).
  2. Check the log files:
    • If more than five inputs are enabled, five backup log files are created at the same time.
    • If fewer than five inputs are enabled, the number of backup log files created corresponds to the number of enabled inputs.

Expectation:
Only one backup log file (.log.1) should be created when the log file reaches the maxBytes limit.

Actual:
When the .log file first time reaches the maxBytes limit, each process/input tries to rotate the logs files individually (.log.1, .log.2, .log.3, .log.4, .log.5), instead of rotating just one log file (.log.1). If more than five inputs are enabled, five backup log files are created at the same time; if fewer than five inputs are enabled, the number of backup log files created corresponds to the number of enabled inputs.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.