On Sun, May 16, 2010 at 10:33 +0800, you wrote:
Is there an easy way to rotate bro log(in
$BROHOME/spool/bro) to 'per day
log' after 24 hours and only archive it in gzip format after 48 hours?
Not out of the box, but the rotation is done via the script defined
by RotateLogs::default_postprocessor. Per default, that is set to
"<prefix>/share/broctl/scripts/archive-log" so you could take that
one as template to write your own.
Robin Sommer * Phone +1 (510) 666-2886 * robin(a)icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org