# Is there no max-files configuration for eve-log?

**URL:** https://forum.suricata.io/t/is-there-no-max-files-configuration-for-eve-log/3688
**Category:** Help
**Tags:** configuration
**Created:** [July 11, 2023, 12:33pm UTC](https://forum.suricata.io/t/is-there-no-max-files-configuration-for-eve-log/3688 "2023-07-11T12:33:21Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![mikel95](https://avatars.discourse-cdn.com/v4/letter/m/94ad74/32.png) [@mikel95](https://forum.suricata.io/u/mikel95)
#### Post date: [July 11, 2023, 12:33pm UTC](https://forum.suricata.io/t/is-there-no-max-files-configuration-for-eve-log/3688/1 "2023-07-11T12:33:21Z")

</div>

Hello,  
I want to rotate the eve.json file. I have set the rotation-interval in eve-log in suricata.yaml(and it works properly) but I would like to set a maximum number of files that should be stored, so that the oldest one is deleted when the limit is reached.

I have seen that there is “max-files” option but for pcap-log. Is there no option to do this?

---

<div class="post-metadata">

### Author: ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [July 11, 2023, 1:53pm UTC](https://forum.suricata.io/t/is-there-no-max-files-configuration-for-eve-log/3688/2 "2023-07-11T13:53:16Z")

</div>

Hi Mikel, welcome to our community!

The example [log rotate script](https://github.com/OISF/suricata/blob/master/etc/suricata.logrotate.in) provided with Suricata is set to go through 5 daily rotations before being removed.

If you need further customization beyond this, a solution for your platform (linux? windows? freebsd?) will be needed.

We offer a working usable configuration for logrotate which meets many workflow needs. Further customization requires a solution fitted to your needs and deployment. There is much content re: logrotate on the interenet.