[Bro] [maintenance] what would cause a backlog/erasure in "...logs/current"?
robin at icir.org
Thu Jan 8 11:37:13 PST 2015
On Thu, Jan 08, 2015 at 12:36 -0600, Gary Faulkner wrote:
> If you restart bro without moving the logs the logs that didn't fully
> get processed on prior rotations first I've noticed those logs tend to
> simply get deleted.
Not good. Broctl should always compress and archive any left-over
logs, not simply delete them on restart. If it doesn't, that's a bug.
For fixing that it would be very helpful to have a way to reproduce
the problem. If anybody knows how to do that, please file a
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin
More information about the Bro