From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4g0YLw1lrHz3076 for ; Tue, 21 Apr 2026 20:08:08 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4g0YLr6tPtz2xQW for ; Tue, 21 Apr 2026 20:08:04 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4g0YLq6SnTz3XV; Tue, 21 Apr 2026 20:08:03 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1776802084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tffNJiGt20vknV/6Ifqa3XdzLjXqLTSJvYQNR2yELKc=; b=CHDbhJ/yrq7PvouLKbdH52tXeB8XRX1M36ru08zb1Vglioqub9sGeLy4YOoqKGd+/MCf2L dH7tYX8fiZw7RCDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1776802084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tffNJiGt20vknV/6Ifqa3XdzLjXqLTSJvYQNR2yELKc=; b=CFih0VmlVFU4BYdOtOPQLqXGSA0qw01ti/zu8j5qgU2tolEU9J6DQqqhNFfuy87Fz2G8RF xHVr5lN9w6j2LfnplkuP2I4DIHNFzqZuH6FCr2k2d59NABNSjJX3Q59fi49cFuwzBtQQ11 xZQEaf2q8xEs2k/skgvMEiVfUM0AXCfszGxAPKA+m86lSrDzZro7TeboKRlLkGUa1ZHY1H DnfEqM4DAQzPLZ0y7Ca9JJuOwtSAOdUROiDzjlb0LuAZZzK9KOvj5niAFc5bX4rW39CxLD 3jGUTupK5SHKNnLCCmjSc3bQYNmq7H0m2BKQWcUN56wCNtdNBxmieAtcCgdXcA== Message-ID: Date: Tue, 21 Apr 2026 22:08:00 +0200 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Subject: Re: Question about potential consequence of patch to rotate Suricata logs daily. To: Bernhard Bitsch References: Content-Language: en-GB Cc: "IPFire: Development-List" From: Adolf Belka In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Bernhard, Thanks for the clarification. So my worries were unfounded, good to know. Regards, Adolf. On 21/04/2026 19:05, Bernhard Bitsch wrote: > Hi, > > the IPS graphs are generated from the iptables collectd samplings. > They are independent from the log files. > The log section of the WUI isn't touched, also. It depends on /var/log/suricata/{fast|alert}.log only. > > BR, > Bernhard > > Am 21.04.2026 um 18:20 schrieb Adolf Belka: >> Hi Michael, >> >> I saw that patch >> >> https://git.ipfire.org/? p=ipfire-2.x.git;a=commit;h=30ccb9ed80ee3ad70403794da4c937fd183b9bd8 >> >> had been created. >> >> It seems to me that this change will mean that there will only ever be 52 days worth of logs for Suricata. The global value for rotate is 52 which is intended to give a tear's worth of data for the various graphs. >> >> With the Suricata logs being rotated daily and with the same global rotate value ( there is no modified rotate value for the Suricata section) then there will only ever be 52 days worth of Suricata Logs. This will mean that the Suricata throughput graph will only show about 7 weeks worth of data when the Year option is selected. >> >> Was this the intent? >> >> If not then there probably needs to be a rotate entry in the Suricata section with rotate 393 to give a year's worth of data but then that will put back the same amount of logs for people who have very small disk drives. >> >> If yes then maybe the Year option on the Suricata graph should be removed or changed to 7 weeks as the 52 days would then be around 7.5 weeks of data available. >> >> It could also be that I am not familiar enough with the rotate package and therefore my concerns are not valid. So I am open to getting clarification. >> >> Best regards, >> >> Adolf. >> > >