[Bro] is there a standars config option for pruning historical logs?
r.fulton at auckland.ac.nz
Thu Oct 17 15:45:22 PDT 2013
Thanks! I had seen that. In my case bro shares a partition with several other disk hungry apps (streamdb and elsa) so I need something with more control then free disk space.
Either number of days or an absolute quota. Absolute quota is safest.
I probably add a cron job to monitor disk usage and prune files from the log directory as needed.
Any interest in me adding this to broctl's cron job?
KeepDays = <digits><units>
LogSizeLimit = <digits><units>
On 18/10/2013, at 7:06 AM, Aashish Sharma <init.conf at gmail.com> wrote:
> Hello Russel:
> Here is a conf setting in your broctl.cfg :
> # Expiration interval for log files in LogDir. Files older than this many days
> # will be deleted upon running "broctl cron".
> LogExpireInterval = 30
> # Lower threshold for space available on the disk that holds SpoolDir. If less
> # space is available, BroControl starts sending out warning emails.
> MinDiskSpace = 5
> Hope this helps,
> On Oct 16, 2013, at 6:49 PM, Russell Fulton <r.fulton at auckland.ac.nz> wrote:
>> Yes, I know it is trivial but if there is a built in way to do it I would rather use it! That way when someone changes the log directory between release it keeps working ;)
>> I am putting much of the data into elsa so there isn't much point in keeping it hanging around in bro-logs for long.
>> Bro mailing list
>> bro at bro-ids.org
More information about the Bro