Influxdb Logs

[DebianGuru]

I have /nsm on a seperate partition, but my main partition (which is of course much smaller) is filling up. I ran ncdu and found something like 40GB of log files under /opt/so/log/infludb. These are all .backup files. Are these critical? Only for restoration? They go back to the beginning of the year (over 10 months). Can I clean these out? Is there a pruning procedure?

[m0duspwnens]

@DebianGuru The only thing that should be in that directory should be a .log and .log.gz files. Do you have a local process creating the .backup files?

[reyesj2]

so-influxdb-clean

Allows you to clear influxdb logs while maintaining a set amount. It will ask you how days/weeks you want to keep. For example you could enter 1d for 1 day or 10w for 10 weeks of influxdb data. Influxdb is where the data for grafana is stored

[DebianGuru]

I tried that and it didn't clean up the log files in /opt/so/log/influxdb folder. I have logs back to March 25th

-rw-r--r-- 1 root root 23788747 Mar 25 2022 influxdb-20220324.log-2022032500.backup
-rw-r--r-- 1 root root 1127943 Mar 25 2022 influxdb-20220324.log.gz-2022032500.backup

[dougburks]

@DebianGuru Please see m0duspwnens's response above. We're not aware of anything in Security Onion that would be creating those .backup files by default. We'd recommend reviewing your system for any local modifications.