Support Questions

Find answers, ask questions, and share your expertise
Check out our newest addition to the community, the Cloudera Data Analytics (CDA) group hub.

When is it safe to move or delete logs from /var/log/hadoop/hdfs/audit/solr/spool ?


We have a problem with the amount of logs building up in /var/log/hadoop/hdfs/audit/solr/spool so I need to remove some of the files from there as a short-term measure. I understand that this data is spooled to disk prior to indexing by solr, so I don't want to move or remove any files that have not yet been processed, or are still active. I can see from lsof that only the latest log is being held open by the NameNode. Does this mean it's safe to remove all log files apart from this last one?





For Log Search default retention period is 7 days and for Ranger 90 days. I will recommend you to store it for default period of time + store all logs in hdfs. If you will delete old log files it wouldn't harm the system.


In any way its better to backup logs

Take a Tour of the Community
Don't have an account?
Your experience may be limited. Sign in to explore more.