From f95712c502d78d8921bb8dbd8921fab8ada29dbc Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 6 Oct 2020 18:38:51 -0400
Subject: [PATCH] update log file

---
 salt/telegraf/scripts/zeekcaptureloss.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/telegraf/scripts/zeekcaptureloss.sh b/salt/telegraf/scripts/zeekcaptureloss.sh
index 4197ef58e..bd1c39277 100644
--- a/salt/telegraf/scripts/zeekcaptureloss.sh
+++ b/salt/telegraf/scripts/zeekcaptureloss.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 {% set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %}
-ZEEKLOG=/host/nsm/zeek/logs/current/capture_loss.log
+ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log
 if [ -f "$ZEEKLOG" ]; then
   LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print "loss: " LOSS}')
   echo "zeekcaptureloss loss=$LOSS"