Log4j2.properties- log rotation issue in ES-7.5.2 Cluster

Hi Team ,
need help on log4j2.properties, not rolling over when new day happens. We are using default log4j2.properties file with elasticsearch-7.5.2 version.

One observation ,in master1&2 nodes are rolling every end of the day.

Data nodes are not rolling logs and showing pervious date log files when the day changed.

We have 4-node cluster like below
master1
master2
hotnode
warmnode

if see below examples shows, Master rolling logs date 23rdjune21 files and Created new log file with date 24thjune21 but where as its not happening in data nodes there is no log file for 24thjune21.

Example: Master1

-rw-r--r--. 1 elk elasticsearch 5.8K Jun 23 21:27 DevElasticStack-2021-06-23-17.log.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 23 22:18 DevElasticStack-2021-06-23-21.json.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 23 22:55 DevElasticStack-2021-06-23-18.log.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 23 23:40 DevElasticStack-2021-06-23-22.json.gz
-rw-r--r--. 1 elk elasticsearch 2.3K Jun 24 00:00 DevElasticStack-2021-06-23-23.json.gz
-rw-r--r--. 1 elk elasticsearch 4.6K Jun 24 00:00 DevElasticStack-2021-06-23-19.log.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 24 01:24 DevElasticStack-2021-06-24-1.json.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 24 01:29 DevElasticStack-2021-06-24-1.log.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 24 02:45 DevElasticStack-2021-06-24-2.json.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 24 02:57 DevElasticStack-2021-06-24-2.log.gz
-rw-r--r--. 1 elk elasticsearch 5.8K Jun 24 04:05 DevElasticStack-2021-06-24-3.json.gz

Example: Data node
-rw-r--r--. 1 elk elasticsearch 1522 Jun 23 16:22 DevElasticStack-2021-06-23-8.log.gz
-rw-r--r--. 1 elk elasticsearch 1694 Jun 23 16:29 DevElasticStack-2021-06-23-11.json.gz
-rw-r--r--. 1 elk elasticsearch 2014 Jun 23 16:29 DevElasticStack-2021-06-23-12.json.gz
-rw-r--r--. 1 elk elasticsearch 2085 Jun 23 16:29 DevElasticStack-2021-06-23-9.log.gz
-rw-r--r--. 1 elk elasticsearch 425024 Jun 23 16:54 DevElasticStack_server.json
-rw-r--r--. 1 elk elasticsearch 367698 Jun 23 16:54 DevElasticStack.log

log4j2.propertes:
appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}-%i.json.gz
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
#appender.rolling.policies.size.size = 128MB
appender.rolling.policies.size.size = 500KB
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.fileIndex = nomax
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = ${sys:es.logs.cluster_name}-*
appender.rolling.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize
appender.rolling.strategy.action.condition.nested_condition.exceeds = 2GB

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.