Version
Cb Response 5.2
Issue
Growth of /var/log/cb/datastore/debug.log increases significantly after upgrade to 5.2. This change in behavior can cause disk full issues depending on disk sizing for /var/log
Symptoms
/var/log/cb/datastore/debug.log shows error message containing the following message with high frequency after 5.2 upgrade:
com.carbonblack.cbfs.storage_model_4.DataStore$Engine$DataStoreOverflowException: Queue full |
Cause
Product changes in 5.2 have increased the frequency of "Queue full" messages in /var/log/cb/datastore/debug.log under normal operation. This is expected behavior and future product versions will reduce the frequency of logging for this message.
Solution
Should additional space requirement for increased logging cause disk full issues, the following solutions may be used to reduce disk usage:
1) Reduce backups retained:
Edit the /etc/cb/datastore/logback.conf.xml (master and all minions) and make the following change (restart is not necessary):
Change from:
<maxHistory>14</maxHistory> |
to
<maxHistory>5</maxHistory> |
2) If continued disk space issues are experienced even with only 5 backups retained, you may selectively turn off logging for EventLogSubmit2.
Edit the /etc/cb/datastore/logback.conf.xml (master and all minions) and make the following change (restart is not necessary):
Locate the following line:
<logger name="com.carbonblack.cbfs" level="WARN" /> |
and add the following line directly after it:
<logger name="com.carbonblack.cbfs.http.servlets.EventLogSubmit2" level="OFF" /> |
