reopen log file to support log rotate
It would be better if suricata can receive a USR signal and reopen log file, so log ratate can
be done easily.
Updated by Victor Julien over 8 years ago
- Status changed from New to Closed
- Target version deleted (
cp http.log http.log.1 && > http.log
I tested this and it works.
Updated by Jorgen Bohnsdalen over 7 years ago
Today Suricata (1.3.1) doesn't reopen the logfiles when doing a logrotate. Since HTTP-logs tend to be huge, it'd be nice if Suricata supported receiving a signal for re-opening log-files. The solution provided here is not a solution for this feature. Logrotating is something that most definitely should be supported without restarting Suricata (and possibly suffering a few minutes of downtime).
Updated by Digital Ninja over 7 years ago
Victor's solution on #4 seems to work fine on Ubuntu 12.04/64-bit. Alternatively, logrotate is also working for me with this configuration:
echo > /var/log/suricata/http.log
chown ids:ids /var/log/suricata/http.log