[Bro] Extracted files don't rotate

James Lay jlay at slave-tothe-box.net
Wed Feb 8 14:17:49 PST 2017

On 2017-02-08 15:10, Azoff, Justin S wrote:
>> On Feb 6, 2017, at 12:32 PM, James Lay <jlay at slave-tothe-box.net> 
>> wrote:
>> Hey all,
>> In looking, I see that the files are accumulating and not rotating 
>> out.
>> Anything I can do to troubleshoot this?  Thank you.
> Ah yes.. Extracted files aren't managed by anything.  If you want
> files archived in a specific way you need to extract them to the full
> path that you want or setup a cron job to move+compress them
> periodically.
> If you had something specific in mind I could probably whip up an
> example script for you.

Thanks Justin that's helpful.  So as I look at my old setup I see that I 
indeed had move and compress manually on a cron job, so I'll just do 
that for the extract_files dir.  Maybe a feature request down the road 
would be (maybe in broctl.conf) to be able to add "pre" rotate and 
"post" rotate scripts.  Just a thought.


More information about the Bro mailing list