[Bro] LogExpireInterval not respected?
Tyler T. Schoenke
tyler.schoenke at colorado.edu
Tue Feb 12 06:55:34 PST 2013
broctl cron typically doesn't give output. If it is hanging, you should
check for other instances of broctl cron running and kill them. They
will sometimes log jam. I haven't figured out why that happens.
Network Security Program Manager
IT Security Office
University of Colorado at Boulder
On 2/11/13 9:40 PM, Jesse Bowling wrote:
> Hi Tyler,
> Thanks for the response.
> Yes, I have ensured that these have been run...I've also tried just
> running 'broctl cron' manually, but I get no output and it never seems
> to quit (or at least, outlasts my patience)...Any other hints?
> On Mon, Feb 11, 2013 at 4:34 PM, Tyler T. Schoenke
> <tyler.schoenke at colorado.edu <mailto:tyler.schoenke at colorado.edu>> wrote:
> Have you run broctl install && broctl check? I always forget to do
> that after modifying LogExpireInterval.
> Tyler Schoenke
> Network Security Program Manager
> IT Security Office
> University of Colorado at Boulder
> On 2/11/13 1:57 PM, Jesse Bowling wrote:
> > Hi,
> > In my /usr/local/bro/etc/broctl.cfg I've specified:
> > LogExpireInterval = 14
> > Additionally in /etc/cron.d/bro I've specified:
> > 0-59/5 * * * * /usr/local/bro/bin/broctl cron
> > However I've found that I have more daily directories present
> that 14
> > days...What configuration options should I be checking to
> > this problem?
> > Thanks,
> > Jesse
> > --
> > Jesse Bowling
> Jesse Bowling
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro