# Question on log rotation

**URL:** <https://community.zeek.org/t/question-on-log-rotation/2947>\
**Category:** Zeek\
**Created:** [December 19, 2013, 11:57pm UTC](https://community.zeek.org/t/question-on-log-rotation/2947 "2013-12-19T23:57:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gary\_Faulkner](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@Gary\_Faulkner](https://community.zeek.org/u/Gary_Faulkner)\
**Post date:** [December 19, 2013, 11:57pm UTC](https://community.zeek.org/t/question-on-log-rotation/2947/1 "2013-12-19T23:57:35Z")

</div>

I had a situation where log rotation and post-processing (summary emails) were not completing. New logs would get started and each previous hour's logs renamed, but not get compressed and moved, which means that many of the previous logs were still in /current (or are they really in \<path-to-bro\>/spool/manager?). In any case upon stopping bro via broctl it appears that only the most current log got processed and archived while all of the logs in between that never got processed seem to simply have gotten deleted. Are those logs simply lost or somewhere other than the dated archive folder and /current folder? If so, is this expected behavior, or is there normally something that would check to see if previous logs failed to rotate out?

Regards,

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [December 20, 2013, 1:45am UTC](https://community.zeek.org/t/question-on-log-rotation/2947/2 "2013-12-20T01:45:27Z")

</div>

I’ve noticed this before on Bro 2.1. I ended up writing a quick python script and configured it as an hourly cron job to complete the compression and move. I’ve attached it here. Hope this helps.

Eric

[bro\_missed\_rotate.py](https://community.zeek.org/uploads/short-url/bbYoianGO4knKxahw9mCSIdyBiq.py) (2.05 KB)

---

<div class="post-metadata">

**Author:** ![Gary\_Faulkner](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@Gary\_Faulkner](https://community.zeek.org/u/Gary_Faulkner)\
**Post date:** [December 20, 2013, 2:33am UTC](https://community.zeek.org/t/question-on-log-rotation/2947/3 "2013-12-20T02:33:25Z")

</div>

Thank you, that should actually be very helpful, and not just for this problem, but also because I have a couple python books on my reading list over winter break, along with Applied NSM.

~Gary

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/question-on-log-rotation/2947/4 "2022-05-06T15:41:28Z")

</div>