ensure at least 2 eve files are kept https://github.com/Security-Onion-Solutions/securityonion/issues/2989

salt/suricata/cron/so-suricata-eve-clean

@@ -25,6 +25,9 @@ read lastPID < $lf
 echo $$ > $lf
 
 MAXEVES={{ salt['pillar.get']('suricata:cleanup:eve_json', 20) }}
+if [ "$MAXEVES" -lt 2 ]; then
+  MAXEVES=2
+fi
 
 # Find eve files and remove them
 NUMEVES=$(find /nsm/suricata/ -type f -name "eve-*.json" | wc -l)