Logrotate and doc updates for threaded Eve logging - v1 #5436
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
jasonish
commented
Sep 23, 2020
jasonish
commented
- Update logrotate template.
- Update logrotation documentation to mention threaded Eve logging
4 spaces seems to be the norm on Linux, so reindent from a mix of 8 spaces and tabs to 4 spaces.
Move old log files to an "olddir". This will make it easier for other tools consuming Eve files to operate, and not pick up rotated log files. Add threaded Eve log files to the filename match for rotation in a that should not match existing rotated files such as "eve.json.1.1". This is not strictly required when using olddir, but may prevent issues when users only use a portion of our provided file as a template.
Suggest the use of logrotate's "olddir" option if using threaded Eve log.
|
See #5444 which adjusts the filename from |
jlucovsky
reviewed
Sep 25, 2020
| endscript | ||
|
|
||
| # If using threaded Eve output, it is best to move old logs to | ||
| # their own directory. But it also works fine when not usint |
|
I think this needs an update after the merge of #5461 |
|
Updated here: #5475 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.