<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 7 jul 2014, at 17:02, Yasha Zislin <<a href="mailto:coolyasha@hotmail.com">coolyasha@hotmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style>
<div dir="ltr">I am trying to logrotate stats.log file<br><br>My logrotate config for that file is <br>/var/log/suricata/stats.log {<br> missingok<br> notifempty<br> size 20k<br> weekly<br> create 0640 suricata suricata<br>}<br><br>I am not an expert on logrotate but this was working for other system files like syslog.<br><br>So stats.log rotated this past friday but Suricata is still writting to old file.<br></div></div></blockquote><div><br></div><div>You should use the "copytruncate " </div><div>option aswell ...</div><div><br></div><div>size 20k - is way too small in my opinion.</div><br><blockquote type="cite"><div><div dir="ltr">-rw-r----- 1 suricata suricata 0 Jul 6 03:12 stats.log<br>-rw-r----- 1 root root 1019158188 Jul 7 11:01 stats.log-20140706<br><br>Does anybody know how to get logrotation configured with Suricata for stats.log file?<br><br>Thanks.<br> </div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span>OISF: <a href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a></span></div></blockquote></body></html>