[Bro] [maintenance] what would cause a backlog/erasure in "...logs/current"?

[Robin Sommer]

On Thu, Jan 08, 2015 at 12:36 -0600, Gary Faulkner wrote:

> If you restart bro without moving the logs the logs that didn't fully
> get processed on prior rotations first I've noticed those logs tend to
> simply get deleted.

Not good. Broctl should always compress and archive any left-over
logs, not simply delete them on restart. If it doesn't, that's a bug.
For fixing that it would be very helpful to have a way to reproduce
the problem. If anybody knows how to do that, please file a
corresponding ticket.

Robin


-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin