Splunk web_access.log rotation

Applicability

Description

This article will explain how Splunk's web_access.log rotates and where to control the settings. 

Resolution

Splunk's web_access.log logs requests made of Splunk Web, in an Apache access_log format.

Much of the types of events logged here are logged in splunkd_ui_access.log starting in 6.2.

Link to the log file settings.

Modify the following settings to change the default rotation for web_access.log

log.access_maxsize = <integer>
log.access_maxfiles = <integer>

The default settings from "$SPLUNK_HOME/etc/system/default/web.conf"  is below:

# Maximum file size of the access log, in bytes
log.access_maxsize = 25000000
# Maximum number of rotated log files to retain
log.access_maxfiles = 5

By default the logs will be rotated in the following sequence: "web_access.log, web_access.log.1, web_access.log.2, ... web_access.log.5"

If you notice the logs are rotated with different behaviour such as adding a date or compressed web_access.log-20240510, web_access.log-20240510.zip, then this could be cause by the custom logrotate setting in the system, which is outside of Splunk's control 

Related Links

Webconf

logrotate