mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-07 17:52:46 +01:00
54 lines
2.6 KiB
Bash
54 lines
2.6 KiB
Bash
#!/bin/bash
|
|
|
|
# Delete Zeek Logs based on defined CRIT_DISK_USAGE value
|
|
|
|
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
|
|
clean () {
|
|
|
|
SENSOR_DIR='/nsm'
|
|
CRIT_DISK_USAGE=90
|
|
CUR_USAGE=$(df -P $SENSOR_DIR | tail -1 | awk '{print $5}' | tr -d %)
|
|
LOG="/nsm/zeek/logs/zeek_clean.log"
|
|
|
|
if [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ]; then
|
|
while [ "$CUR_USAGE" -gt "$CRIT_DISK_USAGE" ];
|
|
do
|
|
TODAY=$(date -u "+%Y-%m-%d")
|
|
|
|
# find the oldest Zeek logs directory and exclude today
|
|
OLDEST_DIR=$(ls /nsm/zeek/logs/ | grep -v "current" | grep -v "stats" | grep -v "packetloss" | grep -v "zeek_clean" | sort | grep -v $TODAY | head -n 1)
|
|
if [ -z "$OLDEST_DIR" -o "$OLDEST_DIR" == ".." -o "$OLDEST_DIR" == "." ]
|
|
then
|
|
echo "$(date) - No old Zeek logs available to clean up in /nsm/zeek/logs/" >> $LOG
|
|
exit 0
|
|
else
|
|
echo "$(date) - Removing directory: /nsm/zeek/logs/$OLDEST_DIR" >> $LOG
|
|
rm -rf /nsm/zeek/logs/"$OLDEST_DIR"
|
|
fi
|
|
|
|
# find oldest files in extracted directory and exclude today
|
|
OLDEST_EXTRACT=$(find /nsm/zeek/extracted/complete -type f -printf '%T+ %p\n' 2>/dev/null | sort | grep -v $TODAY | head -n 1)
|
|
if [ -z "$OLDEST_EXTRACT" -o "$OLDEST_EXTRACT" == ".." -o "$OLDEST_EXTRACT" == "." ]
|
|
then
|
|
echo "$(date) - No old extracted files available to clean up in /nsm/zeek/extracted/complete" >> $LOG
|
|
else
|
|
OLDEST_EXTRACT_DATE=`echo $OLDEST_EXTRACT | awk '{print $1}' | cut -d+ -f1`
|
|
OLDEST_EXTRACT_FILE=`echo $OLDEST_EXTRACT | awk '{print $2}'`
|
|
echo "$(date) - Removing extracted files for $OLDEST_EXTRACT_DATE" >> $LOG
|
|
find /nsm/zeek/extracted/complete -type f -printf '%T+ %p\n' | grep $OLDEST_EXTRACT_DATE | awk '{print $2}' |while read FILE
|
|
do
|
|
echo "$(date) - Removing extracted file: $FILE" >> $LOG
|
|
rm -f "$FILE"
|
|
done
|
|
fi
|
|
done
|
|
else
|
|
echo "$(date) - CRIT_DISK_USAGE value of $CRIT_DISK_USAGE not greater than current usage of $CUR_USAGE..." >> $LOG
|
|
fi
|
|
}
|