aboutsummaryrefslogtreecommitdiffstats
path: root/config/suricata/suricata_check_cron_misc.inc
diff options
context:
space:
mode:
Diffstat (limited to 'config/suricata/suricata_check_cron_misc.inc')
-rw-r--r--config/suricata/suricata_check_cron_misc.inc31
1 files changed, 25 insertions, 6 deletions
diff --git a/config/suricata/suricata_check_cron_misc.inc b/config/suricata/suricata_check_cron_misc.inc
index f750c530..70394a23 100644
--- a/config/suricata/suricata_check_cron_misc.inc
+++ b/config/suricata/suricata_check_cron_misc.inc
@@ -72,7 +72,7 @@ function suricata_check_dir_size_limit($suricataloglimitsize) {
}
// Initialize an array of the log files we want to prune
- $logs = array ( "alerts.log", "http.log", "files-json.log", "tls.log", "stats.log" );
+ $logs = array ( "alerts.log", "block.log", "dns.log", "eve.json", "http.log", "files-json.log", "sid_changes.log", "stats.log", "tls.log" );
// Clean-up the logs for each configured Suricata instance
foreach ($config['installedpackages']['suricata']['rule'] as $value) {
@@ -126,8 +126,10 @@ function suricata_check_rotate_log($log_file, $log_limit, $retention) {
// Check the current log to see if it needs rotating.
// If it does, rotate it and put the current time
// on the end of the filename as UNIX timestamp.
+ if (!file_exists($log_file))
+ return;
if (($log_limit > 0) && (filesize($log_file) >= $log_limit)) {
- $newfile = $log_file . "." . strval(time());
+ $newfile = $log_file . "." . date('Y_md_Hi');
try {
copy($log_file, $newfile);
file_put_contents($log_file, "");
@@ -168,10 +170,18 @@ $logs = array ();
// Build an arry of files to check and limits to check them against from our saved configuration
$logs['alerts.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['alert_log_limit_size'];
$logs['alerts.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['alert_log_retention'];
+$logs['block.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['block_log_limit_size'];
+$logs['block.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['block_log_retention'];
+$logs['dns.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['dns_log_limit_size'];
+$logs['dns.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['dns_log_retention'];
+$logs['eve.json']['limit'] = $config['installedpackages']['suricata']['config'][0]['eve_log_limit_size'];
+$logs['eve.json']['retention'] = $config['installedpackages']['suricata']['config'][0]['eve_log_retention'];
$logs['files-json.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['files_json_log_limit_size'];
$logs['files-json.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['files_json_log_retention'];
$logs['http.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['http_log_limit_size'];
$logs['http.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['http_log_retention'];
+$logs['sid_changes.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_limit_size'];
+$logs['sid_changes.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_retention'];
$logs['stats.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['stats_log_limit_size'];
$logs['stats.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['stats_log_retention'];
$logs['tls.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['tls_log_limit_size'];
@@ -190,12 +200,17 @@ if ($config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] ==
$config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] > 0) {
$now = time();
$files = glob("{$suricata_log_dir}/barnyard2/archive/unified2.alert.*");
+ $prune_count = 0;
foreach ($files as $f) {
- if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] * 3600))
+ if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] * 3600)) {
+ $prune_count++;
unlink_if_exists($f);
+ }
}
+ if ($prune_count > 0)
+ log_error(gettext("[Suricata] Barnyard2 archived logs cleanup job removed {$prune_count} file(s) from {$suricata_log_dir}/barnyard2/archive/..."));
+ unset($files);
}
- unset($files);
// Prune aged-out File Store files if any exist
if (is_dir("{$suricata_log_dir}/files") &&
@@ -203,11 +218,15 @@ if ($config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] ==
$now = time();
$files = glob("{$suricata_log_dir}/files/file.*");
foreach ($files as $f) {
- if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['file_store_retention'] * 3600))
+ if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['file_store_retention'] * 3600)) {
+ $prune_count++;
unlink_if_exists($f);
+ }
}
+ if ($prune_count > 0)
+ log_error(gettext("[Suricata] File Store cleanup job removed {$prune_count} file(s) from {$suricata_log_dir}/files/..."));
+ unset($files);
}
- unset($files);
}
}