Compression of archives.log files is not working

15 views
Skip to first unread message

700 grm

unread,
Aug 9, 2019, 10:47:26 AM8/9/19
to ossec-list
Hi, 

I have set  <logall>yes</logall> in ossec.conf, everything was working fine, logs were compressed and moved to archives,
However I've noticed that for last few days, logs are moved to archive however  not compressed at all, maybe it is due to the size of it? 
Previously daily size of archives.log was 300MB and now daily archive.log is 3-15GB.

# ls -lah
-rw-r-----. 1 ossec ossec 2.6G Aug  7 23:59 ossec-archive-07.log
-rw-r-----. 1 ossec ossec 6.7G Aug  8 23:59 ossec-archive-08.log
-rw-r-----. 2 ossec ossec 3.7G Aug  9 14:13 ossec-archive-09.log


Can someone clarify on it please, much apreciated. 

dan (ddp)

unread,
Aug 22, 2019, 9:43:03 AM8/22/19
to ossec...@googlegroups.com
I don't know for sure, but size would be my first guess.
I'd love to move this functionality out of monitord and use the
newsyslog/logrotate already on the system instead.

> --
>
> ---
> You received this message because you are subscribed to the Google Groups "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/e02fb411-5649-4351-a412-0c7b14e9d664%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages