[Bro] is there a standars config option for pruning historical logs?

[Russell Fulton]

Thanks!  I had seen that.  In my case bro shares a partition with several other disk hungry apps (streamdb and elsa) so I need something with more control then free disk space.

Either number of days or an absolute quota.  Absolute quota is safest.

I probably add a cron job to monitor disk usage and prune files from the log directory as needed.

Any interest in me adding this to broctl's cron job?

KeepDays = <digits><units>
LogSizeLimit = <digits><units>

R


On 18/10/2013, at 7:06 AM, Aashish Sharma <init.conf at gmail.com> wrote:

> Hello Russel:
> 
> Here is a conf setting in your broctl.cfg  :
> 
> # Expiration interval for log files in LogDir. Files older than this many days
> # will be deleted upon running "broctl cron".
> LogExpireInterval = 30
> 
> # Lower threshold for space available on the disk that holds SpoolDir. If less
> # space is available, BroControl starts sending out warning emails.
> MinDiskSpace = 5
> 
> -- 
> 
> Hope this helps, 
> 
> Aashish 
> 
> On Oct 16, 2013, at 6:49 PM, Russell Fulton <r.fulton at auckland.ac.nz> wrote:
> 
>> Yes, I know it is trivial but if there is a built in way to do it I would rather use it!  That way when someone changes the log directory between release it keeps working ;)
>> 
>> I am putting much of the data into elsa so there isn't much point in keeping it hanging around in bro-logs for long.
>> 
>> Russell
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>