Is there any issue with setting message processor log retention to 2 days?

[#1]

Currently our /opt/apigee/var/log/edge-message-processor/logs/system.log logs are retained for 10 days. While testing load balanced target servers setup we noticed that the logs are considerably bigger.

To prevent disk space issues, we are planning to retain logs for only 2 days on the message processors. Our splunk does store them for 30 days.

Is doing so against Apigee recommendation? Or are we likely to face any issues if we retain logs for only 2 days on message processors?

--SF1429049--

[#2 · Accepted solution]

Messages Processor (MP) logs should be small. Out of the box MP is configured to write only limited data on the logs in a effort of limiting IO.

If 10 days is too much for your file system, you may be running MP logs in debug mode which is not recommended or these logs may be the product of APIs using message-logging-policy.

Log configuration for MP is located here:

/opt/apigee/edge-message-processor/conf/logback.xml

If message-logging-policy is used, you can configure the policy to use syslog to send the log data to Splunk.

Message Logging Policy

http://docs.apigee.com/api-services/reference/message-logging-policy

See related post on how to configure the system to send system logs (those generated by components, not those generated by Message Logging Policy) to Splunk:

https://community.apigee.com/articles/30200/sending-apigee-service-logs-to-a-remote-syslog-des.html

[#3]

Thanks Maudrit ,

We have similar cases , where MP logging is very high as we have implement the intelligent load balancer in APIGEE . Before that logging size was normal , but now it is increasing very high and we are planning to keep the log for two days . We have the old logs are available in Splunk .

Does it against the Apigee recommendation ? your suggession is welcome .

[#4]

As long as the logs are available on splunk, you can change the log settings and retain for less days @Pralay

[#5]

Thank you Maruti