[Bro] BroControl config to delete instead of archive on rotation

Daniel Thayer dnthayer at illinois.edu
Thu May 25 12:48:59 PDT 2017


BroControl doesn't actually archive logs (Bro does that by running
a script every time the logs are rotated).  BroControl does have
an option to expire archived logs, so you could set something like
this in your broctl.cfg file:
LogExpireInterval = 1hr

You could also turn off compression to reduce the load on your
machine:
CompressLogs = 0

A more drastic option is to modify the archive-log script to delete
the logs before they are archived.



On 5/25/17 1:55 PM, Josh Liburdi wrote:
> Anyone have experience with configuring BroControl to delete log files
> instead of archiving them upon rotation? I have a scenario where it's
> better for me to delete the rotate log files instead of keeping them
> around.
>
> Thanks!
> Josh
>
>


More information about the Bro mailing list