Actions
Feature #1636
closed
BH
JI
Signal rotation of unified2 log file without restart
Feature #1636:
Signal rotation of unified2 log file without restart
Description
It would be good to have the ability of rotating the log files without having to stop/start the Suricata process. Something similar to the SIGUSR2 for the live rule reload.
From OISF user group:
- Give the unified2 output a "nostamp" option like Snort.
- If nostamp is on, subject the unified2 output to HUP file rotation.
Then you could do file rotation like you would done on other output
files like eve. Move the existing one out of the way, HUP Suricata to
start writing to a new file.
Actions