Forum

Hello.

I have a problem. Our event log files are reaching several GB and grows fast.

I have noticed that a lot of events are from Background Jobs. We have background Job which is checking for new documents every minute and performs some actions when finds something new. Most of the time it is doing nothing, just checking for new records.

But it generates a lot of event logs. I do not want to disable event logs for user access or for object changing. Just for this particular Background Job.

So I am searching how to disable records for this particular event (all records, Start, Finish, Authentication etc..)

There is method SetEventLogEventUse(), but I can not figure out how to pass parameters to use it correctly. Syntax assistant does not help much.
Could you please be so kind and provide code sample? (consider that the name of background job is "BackJob1")

Thank you in advance.

Also. Is there any way to store event logs on a separate server? We have fast SSDs for the database and slow HDDs for 1c installation. But logs are written at the installation disk. So I am wondering if a lot of logs could badly affect app performance. If we have, for example, 100 event logs a second, we are reaching HDD IOPS.
Is there any way to pass logs to elasticSearch?

Somebody?

Dear Alexey,

As for managing the event log from your code, please take a look at Chapter 21. THE EVENT LOG of 1C:Enterprise Developer Guide (https://1c-dn.com/library/developer_guide/).

As for working with the event log's data via Elasticsearch, you can take a look at these articles (in Russian):
https://infostart.ru/public/545895/
https://xdd.silverbulleters.org/t/bigdata-logmanager-dlya-1s/62
http://1c.ruboard.ru/webinars/524404/


Best regards,
Vladimir Gurov

Vladimir, I have read and tried to implement the desired behavior but without luck. The manual is not that clear. Could you please provide the code to completely omit log events from particular Background jobs without loosing other type of logs, like user access and data modification.

The platform generates so much logs that the server is running out of disk space because of those events.

Hello, the easiest way is to switch on 1c technological log. With technological log you can filter events you want and set it on a separate disk drive. It is being set up easily, you just need to save xml file with specific format to 1c directory. As to event log you can switch it off or shrink in cofigurator in such a case.

Alex Ogourok,
With technological blog I will lose the possibility for the users to view log data (like who modified some document etc.). I want to stick with the event log, but filter which events are stored. Basically there is no need to store every minute that scheduled job was ran.

Dear Alexey,

My previous answer might mislead you. Sorry about that.

The correct answer is as follows:

The event log does not support disabling events from a particular event source. The purpose of the event log is auditing data changes. Registering events from one source and not registering events from another contradicts this purpose.

To solve your task of reducing the event log file size, we recommend creating a backup copy of the event log file and then deleting outdated information from it.

As for the event log format - sequential (*.lgf) or SQLite(*.lgd). Our experience shows that sequential format is more reliable. So, our recommendation is to use the event log in sequential format and automatically split it by period.

For more information, refer to 1C:Enterprise Administrator Guide.

Best regards,
Vladimir Gurov