mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-19 06:09:23 +02:00
Josh Patterson
84cd966736
The cleanup loop had no progress check or pass limit, so once /nsm was over threshold with nothing left to reclaim it spun at full speed, writing 1.1 GB / 12.5M lines to sensor_clean.log in five hours. Stop when a pass removes nothing, when a pass frees no space, or at MAX_PASSES, and drop the per-pass "no old files" logging in favor of one actionable line. Replace the pgrep guard with flock -n. A find|while read subshell inherits the parent's argv, so pgrep -cf counted one instance as hundreds; it was also check-then-act, which let cron stack up overlapping runs. Paths now derive from SENSOR_DIR with env-overridable LOG/LOCK so the over-threshold path can be tested against a scratch filesystem.