@Alexy 1. TotalSizeCap is across all log files, it is not based on anything else. So with this set depending on number of incremental (%i) 50 MB logs are created each hour, you may ned up retaining less then 10 hours of logs. 2. Max History does not count incremental (%i) logs generated. It is based on the date pattern used %d{yyyy-MM-dd_HH}. So you role logs every hour, so MaxHistory would retain 10 days unless TotalSizeCap is reached before 10 days of logs are created. Logback is not developed by NiFi and has some oddities to it. It works well when using both maxHistory and TotalSizeCap, but you may see odd behavior when only using MaxHistory. When only MaxHistory is used, Logback does not look back further than configured maxHistory. So while a continually running service works great, things get weird when the service is down for a period of time the extends beyond the maxHistory. Lets say you have logs for last 10 hours (hours 1 -10) already and you bring down NiFi for a couple hours. So now you have logs that go back 12 hours (hours 3-12)when you restart the service. Logback will ignore the hour 11 and hour 12 logs since it is only looking to purge the hour 10 logs when the hour rolls over. So a few hours later you would still see the logs for hour 11 and 12 lingering around with a continuous 10 hour block of logs logback is still tracking on. The TotalSizeCap property however would make sure those old logs get deleted. This odd behavior to me was also brought up with logback community, but ultimately community decided to keep this behavior. If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped. Thank you, Matt
... View more
