Customized so-script in security onion

[smallboy69]

hi Team Security Onion

hope this email finds you well

trying to automate a script so that it clears nsm based on capacity of nsm using so-nsm-clear as a baseline

with a schedule check..via crontab

but i notice that Security onion is using cron,

my question is can i add my customized cron job to below screenshot and its impact

appreciate your assistance

Thanks

[dougburks]

Security Onion should automatically purge old data by default. From https://docs.securityonion.net/en/2.3/stenographer.html#output:

Stenographer writes full packet capture to /nsm/pcap/. It will automatically start purging old data once the partition reaches 90%.

From https://docs.securityonion.net/en/2.3/curator.html:

Curator also deletes old indices to prevent your disk from filling up.

For a full description of how Curator deletes old Elasticsearch indices, please see our Elasticsearch documentation:
https://docs.securityonion.net/en/2.3/elasticsearch.html#deleting-indices

If those mechanisms aren't working in your deployment, then we should try to figure out why.

What kind of Security Onion installation is this? (import, eval, standalone, distributed, etc.)

What are the hardware specs of your system including CPU, RAM, and disk? How much disk space and what type?