mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-21 15:14:27 +02:00
Josh Patterson
d87deb6671
LogExpireInterval, StatsLogExpireInterval, CrashExpireInterval, MinDiskSpace and MailHostUpDown are only acted on by ZeekControl's 'cron' command, which nothing ever ran, so setting them in SOC had no effect. Track those five in /opt/so/state/zeek/zeekctl_cron_settings and trigger the cron run off that file, so unrelated edits like CompressLogs don't fire it. Runs as the zeek user to avoid root-owned files under /nsm/zeek, with --no-watch so the crashed-node watchdog doesn't race the container restart.