[Bro] LogExpireInterval not respected?

Tyler T. Schoenke tyler.schoenke at colorado.edu
Tue Feb 12 06:55:34 PST 2013


broctl cron typically doesn't give output.  If it is hanging, you should
check for other instances of broctl cron running and kill them.   They
will sometimes log jam.  I haven't figured out why that happens.  

Tyler

--
Tyler Schoenke
Network Security Program Manager
IT Security Office
University of Colorado at Boulder


On 2/11/13 9:40 PM, Jesse Bowling wrote:
> Hi Tyler,
>
> Thanks for the response.
>
> Yes, I have ensured that these have been run...I've also tried just
> running 'broctl cron' manually, but I get no output and it never seems
> to quit (or at least, outlasts my patience)...Any other hints?
>
> Cheers,
>
> Jesse
>
> On Mon, Feb 11, 2013 at 4:34 PM, Tyler T. Schoenke
> <tyler.schoenke at colorado.edu <mailto:tyler.schoenke at colorado.edu>> wrote:
>
>     Have you run broctl install && broctl check?    I always forget to do
>     that after modifying LogExpireInterval.
>
>     Tyler
>
>     --
>     Tyler Schoenke
>     Network Security Program Manager
>     IT Security Office
>     University of Colorado at Boulder
>
>
>     On 2/11/13 1:57 PM, Jesse Bowling wrote:
>     > Hi,
>     >
>     > In my /usr/local/bro/etc/broctl.cfg I've specified:
>     >
>     > LogExpireInterval = 14
>     >
>     > Additionally in /etc/cron.d/bro I've specified:
>     >
>     > 0-59/5 * * * * /usr/local/bro/bin/broctl cron
>     >
>     > However I've found that I have more daily directories present
>     that 14
>     > days...What configuration options should I be checking to
>     troubleshoot
>     > this problem?
>     >
>     > Thanks,
>     >
>     > Jesse
>     >
>     > --
>     > Jesse Bowling
>     >
>
>
>
>
> -- 
> Jesse Bowling
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130212/59a8e92c/attachment.html 


More information about the Bro mailing list