Commit Graph
17 Commits
Author SHA1 Message Date
Josh Patterson 84cd966736 FIX: prevent so-sensor-clean runaway loop and concurrent instances
The cleanup loop had no progress check or pass limit, so once /nsm was over
threshold with nothing left to reclaim it spun at full speed, writing 1.1 GB /
12.5M lines to sensor_clean.log in five hours. Stop when a pass removes
nothing, when a pass frees no space, or at MAX_PASSES, and drop the per-pass
"no old files" logging in favor of one actionable line.

Replace the pgrep guard with flock -n. A find|while read subshell inherits the
parent's argv, so pgrep -cf counted one instance as hundreds; it was also
check-then-act, which let cron stack up overlapping runs.

Paths now derive from SENSOR_DIR with env-overridable LOG/LOCK so the
over-threshold path can be tested against a scratch filesystem.
2026-09-14 12:14:13 -04:00
Jason Ertel 7f07c96a2f pcapout still used for extracts 2026-03-09 14:58:27 -04:00
Jason Ertel e8adea3022 restore pcapout since it's still used 2026-03-07 08:20:08 -05:00
Jason Ertel 71839bc87f remove steno 2026-03-06 15:45:36 -05:00
Mike Reeves 2bd9dd80e2 Move In Day 2022-09-07 09:06:25 -04:00
Doug Burks 8fc03afdc0 so-sensor-clean pgrep should be more strict to avoid matching multiples on Ubuntu 2022-04-20 16:47:18 -04:00
Doug Burks e65f2a5513 FIX: Prevent multiple instances of so-sensor-clean #6622 2022-03-16 13:28:39 -04:00
Jason Ertel eefcc929c2 Update copyright pattern to match other repos 2022-01-24 10:09:23 -05:00
Josh Brower 94352c212f Fix so-playbook-sync 2021-04-22 13:26:41 -04:00
Josh Brower 679925ebd9 Fix sensor cleanup & playbook sync scripts 2021-03-30 13:29:56 -04:00
m0duspwnens 944817732b grep for the scrip to be running https://github.com/Security-Onion-Solutions/securityonion/issues/2722 2021-01-25 15:22:04 -05:00
William Wernert 2ad3f9da11 [fix] Wazuh not saving .log files anymore, only check .json files 2020-10-08 12:41:51 -04:00
William Wernert 5dfd11a018 [feat] Add wazuh archive cleanup + fix indentation 2020-10-05 13:58:49 -04:00
weslambert a8f727ad40 Don't write to log if not past CRIT_DISK_USAGE 2020-08-25 11:19:36 -04:00
Mike Reeves 7b1ca5f361 Fix common tools permissions 2020-07-18 22:50:08 -04:00
weslambert eb2dc0be4c Fix value 2020-07-10 17:17:33 -04:00
Wes Lambert 6e99ca600f Move zeek_clean to so-sensor-clean 2020-07-10 17:56:40 +00:00