# log rotation leaving conn.log unrotated

**URL:** <https://community.zeek.org/t/log-rotation-leaving-conn-log-unrotated/3572>\
**Category:** Zeek\
**Created:** [April 27, 2015, 3:32pm UTC](https://community.zeek.org/t/log-rotation-leaving-conn-log-unrotated/3572 "2015-04-27T15:32:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Franky](https://avatars.discourse-cdn.com/v4/letter/f/958977/32.png) [@Franky](https://community.zeek.org/u/Franky)\
**Post date:** [April 27, 2015, 3:32pm UTC](https://community.zeek.org/t/log-rotation-leaving-conn-log-unrotated/3572/1 "2015-04-27T15:32:49Z")

</div>

Hi.

Before I ask yet another question, I wanted to say thanks to all who helped me  
during the last weeks. 🙂 All tips where very helpful and fast! I hope I can repay  
for this by contributing in the future.

I have this simple bro file:

redef Log::default\_rotation\_postprocessor\_cmd = “./postrotate.sh”;  
redef Log::default\_rotation\_interval = 10 sec;

with postrotate.sh just printing the parameters:

echo “-1-”

echo $1  
echo $2  
echo $2  
echo $2  
echo $2  
echo “-2-”

Now when bro is terminated via CTRL-C, the script is called:

1430147916.038582 received termination signal  
1430147916.038582 1865 packets received on interface eth0, 45 dropped

-1-  
files.2015-04-27-17-18-30.log  
files  
15-04-27\_17.18.30  
15-04-27\_17.18.36  
1  
ascii  
-2-  
-1-  
http.2015-04-27-17-18-30.log  
http  
15-04-27\_17.18.30  
15-04-27\_17.18.36  
1  
ascii  
-2-  
-1-  
weird.2015-04-27-17-18-30.log  
weird  
15-04-27\_17.18.30  
15-04-27\_17.18.36  
1  
ascii  
-2-  
-1-  
conn.2015-04-27-17-18-30.log  
conn  
15-04-27\_17.18.30  
15-04-27\_17.18.36  
1  
ascii  
-2-  
-1-  
reporter.2015-04-27-17-18-36.log  
reporter  
15-04-27\_17.18.36  
15-04-27\_17.18.36  
1  
ascii  
-2-

After that there is still a conn.log around. Why is this file not rotated?

When I restart bro now, the conn.log seems to be overwritten and  
entries for example in files.log reference a uid not found in any of  
the conn.logs.

Franky

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/log-rotation-leaving-conn-log-unrotated/3572/2 "2022-05-06T15:42:37Z")

</div>