Hello,
Is there a method to roll certain Zeek logs at a particular time instead
of a count of seconds from 0000? I was hoping setting a log to roll
after 86404 seconds, and then restarting Zeek at the time I wanted the
log to roll, would roll the log then and then persist as the time to
roll, but it also rolled at midnight, which makes sense of course for
basic syslogging.
Thanks in advance for any advice.
Hello,
Is there a method to roll certain Zeek logs at a particular time instead
of a count of seconds from 0000? I was hoping setting a log to roll
after 86404 seconds, and then restarting Zeek at the time I wanted the
log to roll, would roll the log then and then persist as the time to
roll, but it also rolled at midnight, which makes sense of course for
basic syslogging.
I think the main issue (you need to decide how much of an issue
it is) is that the informational emails depend on the same cronjob
(for a lack of a better term) that rotates the logs. In my case I did
not care much about that, hoping warning emails will be sent
regardless, and I delegated log rotating to the system (rsyslog +
logrotate in my case).