zeek LogExpireInterval

[danielo37]

Version

2.4.2

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

293G

Storage for /nsm

924G

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello community,
I wonder if the parameter zeek.config.zeekctl.LogExpireInterval works or not?
I set that to a lower number (10) expecting it to delete all zeek logs exept the ones for last 10 days but I didn't get any results no matter how much I waited, is that correct syntax (just the number 10 not 10d or something else) and does that mean days folders or what exactly, I found elsewhere that I need to run a cronjob to delete files because it is not suported by security onion yet!!!

Thank you for the great help.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

Log files on sensors are cleaned up by so-sensor-clean based on disk usage of /nsm