Open Chancepants opened 11 months ago
Hello, I believe the expected behavior is docker-splunk surfaces splunkd_stderr.log to containers stdout. And that docker-splunk should tolerates file rotation.
Please let me know if you have any questions. -Zach
The tail command used to emit
splunkd_stderr.log
(or a custom log file) to stdout does not handle the file being rotated/renamed. The current command uses-f
https://github.com/splunk/docker-splunk/blob/9.1.1/splunk/common-files/entrypoint.sh#L65 but likely should use-F
In my current environment I have splunk running container image 9.0.6 and have verified the tail command is running via
ps aux | grep tail
and logs are actively being written tosplunkd_stderr.log
. I've also confirmed logs stopped being written to stdout immediately after file rotationsplunkd_stderr.log -> splunkd_stderr.log.1
.