When is it safe to move or delete logs from /var/log/hadoop/hdfs/audit/solr/spool ?

[#1]

Hi

We have a problem with the amount of logs building up in /var/log/hadoop/hdfs/audit/solr/spool so I need to remove some of the files from there as a short-term measure. I understand that this data is spooled to disk prior to indexing by solr, so I don't want to move or remove any files that have not yet been processed, or are still active. I can see from lsof that only the latest log is being held open by the NameNode. Does this mean it's safe to remove all log files apart from this last one?

Thanks

Richard

[#2]

For Log Search default retention period is 7 days and for Ranger 90 days. I will recommend you to store it for default period of time + store all logs in hdfs. If you will delete old log files it wouldn't harm the system.

[#3]

In any way its better to backup logs