Hello,

We are running into a constant problem where logs are rotating due to the amount of cases (incidents) that we are running through the functions. Is there a way to increase the log retention to be greater than it is right now? 

We don't care if we need to go into the container to get them but we would like to have more then a day and half or less of logs. We have a lot of times where we have busy functions that run on a lot of our cases making this buffer of logs hard to get ot unless we are right on top of it within the hour or couple hours of the event.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh
------------------------------

Hi Richard,

The method that i used for a while is storing app logs on my Splunk(it may be any solution). In this way, i can search historically as much as i want. I can create dashboard or analytic reports.

I used Splunk Forwarder to forward logs but you may use any method to do it. (syslog or any agent)

To send logs, you can use below path.
//var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/*/fs/var/log/rescircuits/app.log

------------------------------
Burak Karaduman
------------------------------