How to delete old logs to free up space?

[Enekupe Lelevaga]

[Tomas Sarquis]

Hello @enetupevaga!

You may be interested in Wazuh's rotation functionality.

We have a daemon called monitord which, among other things, is in charge of rotating (and compressing) files.
When rotation is enabled and the current log file reachs some max size or is old enough, monitord creates a new file for storing new upcoming log data. The old (rotated) log file is renamed as shown below:

• /var/ossec/logs/wazuh/<YEAR>/<MONTH>: Rotated files ossec.log
• /var/ossec/logs/alerts/<YEAR>/<MONTH>: Rotated files alerts.log|json
• /var/ossec/logs/archives/<YEAR>/<MONTH>: Rotated files archives.log|json
• /var/ossec/logs/api/<YEAR>/<MONTH>: Rotated files api.log
• /var/ossec/logs/cluster/<YEAR>/<MONTH>: Rotated files cluster.log
• /var/ossec/logs/firewall/<YEAR>/<MONTH>: Rotated files firewall.log

Important: Wazuh is not going to remove this old files. You have to do it manually or with some scheduler like crontab.

Monitord main configuration
There are 4 setting related to logs rotations that you can configure in the /var/ossec/etc/local_internal_options.conf file:

• monitord.rotate_log: This setting enables log rotation, it is enabled by default.
• monitord.size_rotate: With this setting you can configure the maximum size of the file to trigger rotation, it is set to 512MB by default.
• monitord.daily_rotations: With this setting you can configure the maximum number of rotations per day, it is set to 12 by default.
• monitord.keep_log_days: With this setting you can configure the number of days to store the rotated logs before delete them, by default it is 31 days.

For complete information: Documentation

Let me know if I can help you with any other thing.

On Tuesday, September 13, 2022 at 5:12:48 PM UTC-3 enetu...@gmail.com wrote:

[Tomas Sarquis]

One last thing: if you need help with crontab, let me know.

[Enekupe Lelevaga]

YEs please,   need help with crontab

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/d095455f-5445-44ac-9b9c-478b6b9f3abbn%40googlegroups.com.

[Tomas Sarquis]

 For example, to apply a deletion of alerts and archives older than 7 days, then run crontab -e (as root) then paste next piece of text:

0 0 * * mon find /var/ossec/logs/alerts/ -type f -mtime +7 -exec rm -f {} ; 

0 0 * * mon find /var/ossec/logs/archives/ -type f -mtime +7 -exec rm -f {} ;

[Bhaskar Patel]

thank you  in advance... 

Is there any has checked this or already using please inform me this will help me a lot "I need to enable 2fector on the wazuh indexer console is it possible?"

Thanks,

Bhaskar Patel