CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: use mountpoint for Elastic log limit

Browse Source 
Instead of just existence, this checks if the directories are separate mountpoints when determining disk size and log_size_limit calculations.

It also sets the percentage to 80 if /nsm/elasticsearch is a separate mountpoint.  This allows for better disk utilization on server configurations where /nsm is based on large slow HDDs for increased PCAP retention but /nsm/elasticsearch is based on SSDs for faster Elasticsearch performance.
This commit is contained in:
Pete
2024-02-02 12:25:16 -05:00
committed by GitHub
parent 4dd0b4a4fd
commit cf83d1cb86
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
setup/so-functions
View File

@@ -2148,11 +2148,12 @@ set_default_log_size() {
esac esac
local disk_dir="/" local disk_dir="/"
if [ -d /nsm ]; then if mountpoint -q /nsm; then
disk_dir="/nsm" disk_dir="/nsm"
fi fi
if [ -d /nsm/elasticsearch ]; then if mountpoint -q /nsm/elasticsearch; then
disk_dir="/nsm/elasticsearch" disk_dir="/nsm/elasticsearch"
percentage=80
fi fi
local disk_size_1k local disk_size_1k