mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
da64eace18
With rotate-interval set to minute, hour or day, rotations were not aligned to the local time boundaries. The first rotation was computed by SCGetSecondsUntil(), which overshoots the next hour by one minute (hh:01:00) and the next day by one hour and one minute (01:01:00). Every following rotation was re-armed with a fixed interval (e.g. 86400 s) from the time of the rotation. Local days are not always 86400 s long, so the day rotation also moved by the DST shift on every DST transition and stayed there until the next one. A file named after a date then held events of the next day. Instead, this commit rotates logs when the local minute, hour or date changes. The daily rotation now happens at local midnight. On SIGHUP, the period is recorded before the file is reopened, so a boundary (the next minute/hour/day) passing during the reopen leads to an extra reopen instead of a missed rotation. Ticket: #9139 |
4 days ago | |
|---|---|---|
| .. | ||
| eve-json-examplesjq.rst | ||
| eve-json-format.rst | 3 weeks ago | |
| eve-json-output.rst | 4 days ago | |
| index.rst | ||