/usr/local/zeek/spool/tmp/post-terminate log cleanup

Zeek v6.0.1

Does Zeek have a config setting or does it automatically clean up the post-terminate logs created every time Zeek stops?

Hi there,

Zeek’s ASCII log writer has a built-in mechanism (dubbed “shadow files”) to clean up leftover logs that it encounters on a subsequent run. There are also nuances to the log processing itself — if you’re using ZeekControl for your cluster, you’re likely post-processing your logs via archive-log. You could try the newer zeek-archiver instead, since it avoids some potential corner cases.