I have a perplexing problem with rotating logs but I’m sure there is a simple fix. Unfortunately, the simple fix has eluded me. Although there are similar postings that are similar to the issue I am experiencing, none of the postings are exactly the same.
The eve(thread number).json (ie: eve.71.json) and other Suricata log files do not get rotated as expected (hourly or daily, depending on where I’ve placed ‘Logrotate’ ie, /etc/cron.daily or cron.hourly). If I perform (logrotate -f /etc/logrotate.d/surcata), the eve.json DOES rotate to a new filename (example: eve.json-20220101) but Suricata will continue updating the newly rotated log. The new eve.json file remains at zero bytes and never grows but the Suricata process continues to run… Thereafter, hourly or daily rotation continues to NOT function as expected.
Log file rotation of all other file system logs appear to be rotating as expected which makes me believe the problem is related to Suricata or possbly Napatech.
Any insights or suggestions to resolve this problem?
Suricata 6.0.4 was but built for support of Napatech SmartNic (12.7) on Ubuntu 20.04.3.
Contents of logrotate config (/etc/logrotate.d/suricata):
cat /usr/local/var/run/suricata.pid 2>/dev/null 2>/dev/null || true
No differences are observed with functionality no matter if the “Logrotate” script (built by the Ubuntu OS) is located in /etc/cron.daily or /etc/cron.hourly.
Suricata yaml file (pertinent statements)
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
command line statement used to start suricata
suricata -vvvv -D --pidfile -c /usr/local/var/run/suricata.pid /usr/local/etc/suricata/suricata.yaml --napatech --runmode workers