[Bro] log files not getting deleted ??

[Daniel Thayer]

Did you remember to do "broctl install" after you changed the
value of LogExpireInterval ?


On 01/30/2014 05:10 PM, Russell Fulton wrote:
> Hi Folks
>
> I have this in my broctl.cfg file:
>
> # Location of the log directory.  This is longer term storage for rotated logs.
> LogDir = /home/sensors/data/test1/bro-logs
>
> # Rotation interval in seconds for log files on manager/standalone node.
> LogRotationInterval = 3600
>
> # Expiration interval for log files in LogDir. Files older than this many days
> # will be deleted upon running "broctl cron".
> LogExpireInterval = 3
>
> # Lower threshold for space available on the disk that holds SpoolDir. If less
> # space is available, BroControl starts sending out warning emails.
> MinDiskSpace = 5
>
> but I have weeks of logs in the directory ??
>
> rful011 at secmontst01:~$ ls /home/sensors/data/test1/bro-logs
> 2014-01-01  2014-01-04  2014-01-07  2014-01-10  2014-01-13  2014-01-16  2014-01-19  2014-01-22  2014-01-25  2014-01-28  2014-01-31
> 2014-01-02  2014-01-05  2014-01-08  2014-01-11  2014-01-14  2014-01-17  2014-01-20  2014-01-23  2014-01-26  2014-01-29  current
> 2014-01-03  2014-01-06  2014-01-09  2014-01-12  2014-01-15  2014-01-18  2014-01-21  2014-01-24  2014-01-27  2014-01-30  stats
>
> and I have to keep pruning it by hand when the system runs out of disk.
>
> And yes I have checked the con logs to make sure broctl cron is getting run ;)
>
> Any ideas how to figure out what is wrong?
>
> Russell