splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
376 stars 180 forks source link

[BUG] verbosity and debug logging not working in versions 7.x #416

Open mickotronic opened 3 years ago

mickotronic commented 3 years ago

Describe the bug If setting verbosity for eventgen in inputs.conf in versions 7.x, eventgen-main.log does not contain anything. This same configuration would result in debug log output to eventgen-main.log in versions 6.x. There is no documentation that I can find that describes how to attain the same level of debug logging in versions 7.x, so I am making this a bug as it's unexpected behaviour and an undocumented change.

To Reproduce Steps to reproduce the behavior:

  1. In eventgen v6.5.3, set verbosity to 10 or 40 in local inputs.conf. Restart splunk.
  2. Confirm eventgen-main.log contains debug log entries.
  3. Remove eventgen v6.5.3 and install version 7.0.
  4. Use same configuration for verbosity.

Expected behavior eventgen-main.log contains debug information.

Actual behavior On versions 7.x, eventgen-main.log is empty. In some cases it logs errors.

Screenshots

Sample files and eventgen.conf file

Do you run eventgen with SA-eventgen? Yes

If you are using SA-Eventgen with Splunk (please complete the following information):

If you are using eventgen with pip module mode (please complete the following information):

Additional context Add any other context about the problem here.