Good afternoon,
Our eve-*.json files have grown to be very large, so much so that its filled our /data/suricata directory and has subsequently caused any and all suricata and splunk services on the device to stop. Additionally the device has become unable to be SSH’d into.
For example, here are the sizes:
1.6T eve-dnsnt80.json
48G eve-ids-attacknt80.json
15G eve-statsnt80.json
12G eve-statsnt40.json
Are any of these safe to delete?
Additionally, how can we manage these .json files better in the future? Can a cron job be made to delete these logs routinely?
I apologize if this doesn’t make too much sense, I am still very new to Suricata.