wazuh-api
wazuh-api copied to clipboard
Api compressed files are named using a different criteria
Wazuh version | Install type | Install method | Platform |
---|---|---|---|
3.8.2-3814 | Manager | Packages | Ubuntu 16.04.6 LTS |
Hi,
I am uploading .gz
log files generated by Wazuh from the following paths to a S3 repository:
"logs/alerts",
"logs/api",
"logs/archives",
"logs/cluster",
"logs/firewall",
"logs/ossec"
The backup process is performed at 00:05 after .gz
log files are created.
However, compressed logs are named using different criteria.
root@wazuh-manager:/var/ossec/etc# ll /var/ossec/logs/alerts/2019/Apr/
total 20
drwxrwx--- 2 ossec ossec 4096 Apr 23 00:00 ./
drwxrwx--- 3 ossec ossec 4096 Apr 17 15:18 ../
-rw-r----- 1 ossec ossec 321 Apr 23 00:00 ossec-alerts-22.json.gz
-rw-r----- 1 ossec ossec 507 Apr 23 00:00 ossec-alerts-22.json.sum
-rw-r----- 1 ossec ossec 380 Apr 23 00:00 ossec-alerts-22.log.sum
-rw-r----- 2 ossec ossec 0 Apr 23 00:00 ossec-alerts-23.json
-rw-r----- 2 ossec ossec 0 Apr 23 00:00 ossec-alerts-23.log
root@wazuh-manager:/var/ossec/etc# ll /var/ossec/logs/api/2019/Apr/
total 12
drwxr-x--- 2 ossec ossec 4096 Apr 23 00:00 ./
drwxr-x--- 3 ossec ossec 4096 Apr 23 00:00 ../
-rw-r----- 1 ossec ossec 178 Apr 23 00:00 api-23-1.gz
Api compressed files
are named using the current date in the name pattern, while the other logs are named using yesterday date.
Using yesterday date makes sense because those files contains logs from yesterday.
It would be nice if all logs follow the same pattern.
Regards.