Windows Agent - logfile

Icinga 2
1

Hello!
We are using the Windows Agent on many servers and now the icinga.log file gets bigger and bigger.
Is there a setting to limit the size of the log file?
What is best practice for this case?

2

Hi,

on Linux/Unix we recommend to use logrotate, on Windows there is no such thing OOTB to my knowledge. You may create your own PS script which stops the service, renames and/or zips the log files and then start the service again.

Cheers,
Michael

3

I almost thought so…
Thx Michael!

4

Do it as an event handler!

5

I strongly advise against doing such things via the core’s event handler. If this goes nuts, or rotation fails for some reason, the agent won’t be revived again.

6

Fiiiine, I’ll stop promoting bad (fun) ideas in production.

1 Like
7

I disable log on windows agents mostly. Only fir debugging i enable it.

8

To be fair - there’s a feature request open, but I don’t know how to implement it properly. That may or may not be a good candidate for a better logging library as well.

9

Are you worried about potential memory overflow by caching while renaming the file and creating a new one? Probably no issue on clients. Baby might fall down go boom on a master with debug on. The .1 .2 .3 .4 .5 thing could work. Ugly as sin but it could work.

Also, potentially a module to just push errors to the windows event log.

Either way, I now realize I need a check for that file’s size.

10

I’m more worried about event handlers and their purpose and interface. They’re run on state changes, and you cannot rely on that specifically. Now comes the argument to run the check more often then, but seriously, I wouldn’t stress a Windows client with dummy results just for doing some IO tasks. Users will complain about this.

I prefer cronjobs and scheduler services for such a fixed rotation or anything else which must be done outside of the actual monitoring core.

If you google a bit, you’ll find examples for this. I wouldn’t bother with signal handling though, just stop and start the Windows service again.

Cheers,
Michael

11

Oh I was just spitballing on an actual implementation regarding the feature request. Doing that as an event handler would be a nightmare.

I should maybe check and see just how modular that is. I might get bored enough to tinker.