Re: Question about potential consequence of patch to rotate Suricata logs daily.

[Bernhard Bitsch <bbitsch@ipfire.org>]

Hi,

the IPS graphs are generated from the iptables collectd samplings.
They are independent from the log files.
The log section of the WUI isn't touched, also. It depends on 
/var/log/suricata/{fast|alert}.log only.

BR,
Bernhard

Am 21.04.2026 um 18:20 schrieb Adolf Belka:
> Hi Michael,
> 
> I saw that patch
> 
> https://git.ipfire.org/? 
> p=ipfire-2.x.git;a=commit;h=30ccb9ed80ee3ad70403794da4c937fd183b9bd8
> 
> had been created.
> 
> It seems to me that this change will mean that there will only ever be 
> 52 days worth of logs for Suricata. The global value for rotate is 52 
> which is intended to give a tear's worth of data for the various graphs.
> 
> With the Suricata logs being rotated daily and with the same global 
> rotate value ( there is no modified rotate value for the Suricata 
> section) then there will only ever be 52 days worth of Suricata Logs. 
> This will mean that the Suricata throughput graph will only show about 7 
> weeks worth of data when the Year option is selected.
> 
> Was this the intent?
> 
> If not then there probably needs to be a rotate entry in the Suricata 
> section with rotate 393 to give a year's worth of data but then that 
> will put back the same amount of logs for people who have very small 
> disk drives.
> 
> If yes then maybe the Year option on the Suricata graph should be 
> removed or changed to 7 weeks as the 52 days would then be around 7.5 
> weeks of data available.
> 
> It could also be that I am not familiar enough with the rotate package 
> and therefore my concerns are not valid. So I am open to getting 
> clarification.
> 
> Best regards,
> 
> Adolf.
>