Confusing log rotation problem of timestamp

Help
1

hi, i’m using suricata 6.0.4 build from source.
i found that the log rotation doesn’t work correctly.
the timestamp in the log file begins from about 03:20 a.m, and ends at 03:20 a.m in the next day.

image
image

my logrotation settings

/var/log/suricata/*.log /var/log/suricata/*.json {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    minsize 500k
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/suricata.pid 2> /dev/null` 2> /dev/null || true
    suricatasc -c reopen-log-files
    endscript
}

how can i fix this problem, can anyone help me?

2

Try removing the suricatasc -c reopen-log-files part. I don’t have it active on my setups and didn’t run into issues.