# Delete logs after rotating

**URL:** <https://community.zeek.org/t/delete-logs-after-rotating/7919>\
**Category:** Zeek\
**Tags:** logging\
**Created:** [December 16, 2025, 7:54am UTC](https://community.zeek.org/t/delete-logs-after-rotating/7919 "2025-12-16T07:54:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Artyom\_Kalabukhov](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Artyom\_Kalabukhov](https://community.zeek.org/u/Artyom_Kalabukhov)\
**Post date:** [December 16, 2025, 7:54am UTC](https://community.zeek.org/t/delete-logs-after-rotating/7919/1 "2025-12-16T07:54:33Z")

</div>

I encountered a situation where I needed logs to be written at runtime, but after rotation, the log files should not be saved and archived, but deleted.

In the log policy, I found variables for enabling, disabling, and configuring rotation, or disabling logs completely, but I didn’t find anything related to disabling log saving.  
What’s the best way to do this?

I`ve tried to change variables in local.zeek

```auto
@load base/frameworks/logging
redef Log::default_rotation_postprocessor_cmd = "delete-log";

```

But after `systemctl restart zeek` a directory with the date was created and logs were saved and archived there  
p.s Zeek is working in standalone mode

```auto
CGroup: /system.slice/zeek.service
            ├─202734 bash /opt/zeek/share/zeekctl/scripts/run-zeek -1 -i ens18 -U .status -p zeekctl -p zeekctl-live -p standalone -p local -p zeek local.zeek zeekctl zeekctl/standalone zeekctl/auto
            └─202740 /opt/zeek/bin/zeek -i ens18 -U .status -p zeekctl -p zeekctl-live -p standalone -p local -p zeek local.zeek zeekctl zeekctl/standalone zeekctl/auto

```

Maybe I need to change some options in zeekctl.cfg?  
p.s I’ve already tried to add options `LogRotationInterval = 3600, LogExpireInterval = 1 hr` in zeekctl.cfg, but after restart YYYY-MM-DD directory still appeared and collect archieved logs…

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [February 14, 2026, 7:54am UTC](https://community.zeek.org/t/delete-logs-after-rotating/7919/2 "2026-02-14T07:54:43Z")

</div>

This topic was automatically closed after 60 days. New replies are no longer allowed.