# BroControl config to delete instead of archive on rotation

**URL:** <https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858>\
**Category:** Zeek\
**Created:** [May 25, 2017, 7:07pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858 "2017-05-25T19:07:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [May 25, 2017, 7:07pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/1 "2017-05-25T19:07:10Z")

</div>

I don't, but you could try just changing broctl.cfg: CompressCmd = rm

Which really is just (very) lossy compression... 🙂

I've been discussing the need for more fine-grained log expiration with  
a couple of people, but it's hard to give people all the knobs that they  
would need.

&nbsp;&nbsp;--Vlad

Josh Liburdi \<[liburdi.joshua@gmail.com](mailto:liburdi.joshua@gmail.com)\> writes:

---

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [May 25, 2017, 7:18pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/2 "2017-05-25T19:18:20Z")

</div>

Thanks Vlad, that’s an interesting suggestion. We’re looking to minimize unnecessary file activity, so having an explicit option to delete instead of archive could be useful for some.

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [May 25, 2017, 7:52pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/3 "2017-05-25T19:52:56Z")

</div>

Doing that would result in an archived log file of zero length.  
To truly delete the log would currently require modifications  
to the archive-log script.

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [May 25, 2017, 10:19pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/4 "2017-05-25T22:19:31Z")

</div>

I think we already support this, it just was never intended to be used for this purpose:

The archive-log script does this:

# Run other postprocessors.  
if [-d "${postprocdir}"]; then  
&nbsp;&nbsp;&nbsp;&nbsp;for pp in "${postprocdir}"/\*; do  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nice "$pp" $@  
&nbsp;&nbsp;&nbsp;&nbsp;done  
fi

# Test if the log still exists in case one of the postprocessors archived it.  
if [! -f $file\_name]; then  
&nbsp;&nbsp;&nbsp;&nbsp;exit 0  
fi

So I think all one needs to do is

&nbsp;&nbsp;&nbsp;&nbsp;ln -s /bin/rm /usr/local/bro/share/broctl/scripts/postprocessors/rm

---

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [May 26, 2017, 3:06pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/5 "2017-05-26T15:06:51Z")

</div>

Thanks for the feedback everyone.

Somewhat on this topic, have you guys ever thought about adding a socket writer (logging via the network) to Bro? That would be the most efficient way of minimizing disk I/O.

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [May 26, 2017, 3:08pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/6 "2017-05-26T15:08:40Z")

</div>

I've been meaning to write a ZMQ writer and an Exec writer (that you could just use to run something like netcat).

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/brocontrol-config-to-delete-instead-of-archive-on-rotation/4858/7 "2022-05-06T15:44:58Z")

</div>