From 6c0d365bdb5f4e4fdc2bf57561178573be5a36cc Mon Sep 17 00:00:00 2001
From: bmeeks8 <bmeeks8@bellsouth.net>
Date: Tue, 26 Aug 2014 21:39:21 -0400
Subject: Upgrade Suricata to 2.0.3 and GUI package to v2.0

---
 config/suricata/suricata_check_cron_misc.inc | 31 ++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

(limited to 'config/suricata/suricata_check_cron_misc.inc')

diff --git a/config/suricata/suricata_check_cron_misc.inc b/config/suricata/suricata_check_cron_misc.inc
index f750c530..a488d9a9 100644
--- a/config/suricata/suricata_check_cron_misc.inc
+++ b/config/suricata/suricata_check_cron_misc.inc
@@ -72,7 +72,7 @@ function suricata_check_dir_size_limit($suricataloglimitsize) {
 		}
 
 		// Initialize an array of the log files we want to prune
-		$logs = array ( "alerts.log", "http.log", "files-json.log", "tls.log", "stats.log" );
+		$logs = array ( "alerts.log", "block.log", "dns.log", "eve.json", "http.log", "files-json.log", "sid_changes.log" "stats.log", "tls.log" );
 
 		// Clean-up the logs for each configured Suricata instance
 		foreach ($config['installedpackages']['suricata']['rule'] as $value) {
@@ -126,8 +126,10 @@ function suricata_check_rotate_log($log_file, $log_limit, $retention) {
 	// Check the current log to see if it needs rotating.
 	// If it does, rotate it and put the current time
 	// on the end of the filename as UNIX timestamp.
+	if (!file_exists($log_file))
+		return;
 	if (($log_limit > 0) && (filesize($log_file) >= $log_limit)) {
-		$newfile = $log_file . "." . strval(time());
+		$newfile = $log_file . "." . date('Y_md_Hi');
 		try {
 			copy($log_file, $newfile);
 			file_put_contents($log_file, "");
@@ -168,10 +170,18 @@ $logs = array ();
 // Build an arry of files to check and limits to check them against from our saved configuration
 $logs['alerts.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['alert_log_limit_size'];
 $logs['alerts.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['alert_log_retention'];
+$logs['block.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['block_log_limit_size'];
+$logs['block.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['block_log_retention'];
+$logs['dns.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['dns_log_limit_size'];
+$logs['dns.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['dns_log_retention'];
+$logs['eve.json']['limit'] = $config['installedpackages']['suricata']['config'][0]['eve_log_limit_size'];
+$logs['eve.json']['retention'] = $config['installedpackages']['suricata']['config'][0]['eve_log_retention'];
 $logs['files-json.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['files_json_log_limit_size'];
 $logs['files-json.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['files_json_log_retention'];
 $logs['http.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['http_log_limit_size'];
 $logs['http.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['http_log_retention'];
+$logs['sid_changes.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_limit_size'];
+$logs['sid_changes.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_retention'];
 $logs['stats.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['stats_log_limit_size'];
 $logs['stats.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['stats_log_retention'];
 $logs['tls.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['tls_log_limit_size'];
@@ -190,12 +200,17 @@ if ($config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] ==
 		    $config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] > 0) {
 			$now = time();
 			$files = glob("{$suricata_log_dir}/barnyard2/archive/unified2.alert.*");
+			$prune_count = 0;
 			foreach ($files as $f) {
-				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] * 3600))
+				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] * 3600)) {
+					$prune_count++;
 					unlink_if_exists($f);
+				}
 			}
+			if ($prune_count > 0)
+				log_error(gettext("[Suricata] Barnyard2 archived logs cleanup job removed {$prune_count} file(s) from {$suricata_log_dir}/barnyard2/archive/..."));
+			unset($files);
 		}
-		unset($files);
 
 		// Prune aged-out File Store files if any exist
 		if (is_dir("{$suricata_log_dir}/files") &&
@@ -203,11 +218,15 @@ if ($config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] ==
 			$now = time();
 			$files = glob("{$suricata_log_dir}/files/file.*");
 			foreach ($files as $f) {
-				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['file_store_retention'] * 3600))
+				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['file_store_retention'] * 3600)) {
+					$prune_count++;
 					unlink_if_exists($f);
+				}
 			}
+			if ($prune_count > 0)
+				log_error(gettext("[Suricata] File Store cleanup job removed {$prune_count} file(s) from {$suricata_log_dir}/files/..."));
+			unset($files);
 		}
-		unset($files);
 	}
 }
 
-- 
cgit v1.2.3