wazuh-api icon indicating copy to clipboard operation
wazuh-api copied to clipboard

Api compressed files are named using a different criteria

Open Phandora opened this issue 5 years ago • 0 comments

Wazuh version Install type Install method Platform
3.8.2-3814 Manager Packages Ubuntu 16.04.6 LTS

Hi, I am uploading .gz log files generated by Wazuh from the following paths to a S3 repository:

    "logs/alerts",
    "logs/api",
    "logs/archives",
    "logs/cluster",
    "logs/firewall",
    "logs/ossec"

The backup process is performed at 00:05 after .gz log files are created.

However, compressed logs are named using different criteria.

root@wazuh-manager:/var/ossec/etc# ll /var/ossec/logs/alerts/2019/Apr/
total 20
drwxrwx--- 2 ossec ossec 4096 Apr 23 00:00 ./
drwxrwx--- 3 ossec ossec 4096 Apr 17 15:18 ../
-rw-r----- 1 ossec ossec  321 Apr 23 00:00 ossec-alerts-22.json.gz
-rw-r----- 1 ossec ossec  507 Apr 23 00:00 ossec-alerts-22.json.sum
-rw-r----- 1 ossec ossec  380 Apr 23 00:00 ossec-alerts-22.log.sum
-rw-r----- 2 ossec ossec    0 Apr 23 00:00 ossec-alerts-23.json
-rw-r----- 2 ossec ossec    0 Apr 23 00:00 ossec-alerts-23.log

root@wazuh-manager:/var/ossec/etc# ll /var/ossec/logs/api/2019/Apr/
total 12
drwxr-x--- 2 ossec ossec 4096 Apr 23 00:00 ./
drwxr-x--- 3 ossec ossec 4096 Apr 23 00:00 ../
-rw-r----- 1 ossec ossec  178 Apr 23 00:00 api-23-1.gz

Api compressed files are named using the current date in the name pattern, while the other logs are named using yesterday date. Using yesterday date makes sense because those files contains logs from yesterday.

It would be nice if all logs follow the same pattern.

Regards.

Phandora avatar Apr 23 '19 15:04 Phandora