Logrotate
Peter Manev edited this page Jun 16, 2020
·
8 revisions
There is also automatic log rotation implemented in /etc/logrotate.d/suricata
:
/var/log/suricata/eve.json {
daily
rotate 30
olddir /var/log/suricata/StatsByDate/
compress
missingok
notifempty
dateext
postrotate
/bin/kill -HUP $(cat /var/run/suricata.pid)
/bin/kill -HUP $(cat /var/run/logstash.pid)
endscript
}
# to see status
# cat /var/lib/logrotate/status
# to manually test -
# logrotate --force /etc/logrotate.d/suricata
That would logrotate eve.json
daily and would keep max 30 days old logs.You can use the example above for any other log file you would like to logrotate. More info about logrotate.