Skip to content

Logrotate

Peter Manev edited this page Jun 16, 2020 · 8 revisions

There is also automatic log rotation implemented in /etc/logrotate.d/suricata :

/var/log/suricata/eve.json {
   daily
   rotate 30
       olddir /var/log/suricata/StatsByDate/
   compress
   missingok
   notifempty
   dateext
   postrotate
       /bin/kill -HUP $(cat /var/run/suricata.pid)
       /bin/kill -HUP $(cat /var/run/logstash.pid)
   endscript
}

# to see status
# cat /var/lib/logrotate/status
# to manually test - 
# logrotate --force /etc/logrotate.d/suricata

That would logrotate eve.json daily and would keep max 30 days old logs.You can use the example above for any other log file you would like to logrotate. More info about logrotate.

Clone this wiki locally