Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

When is it safe to move or delete logs from /var/log/hadoop/hdfs/audit/solr/spool ?

avatar

Hi

We have a problem with the amount of logs building up in /var/log/hadoop/hdfs/audit/solr/spool so I need to remove some of the files from there as a short-term measure. I understand that this data is spooled to disk prior to indexing by solr, so I don't want to move or remove any files that have not yet been processed, or are still active. I can see from lsof that only the latest log is being held open by the NameNode. Does this mean it's safe to remove all log files apart from this last one?

Thanks

Richard

2 REPLIES 2

avatar
Rising Star

For Log Search default retention period is 7 days and for Ranger 90 days. I will recommend you to store it for default period of time + store all logs in hdfs. If you will delete old log files it wouldn't harm the system.

avatar
Rising Star

In any way its better to backup logs