How to rotate event file?

[qasidali861]

How can I configure the event file rotating policy.

[sebix]

In /etc/logrotate.d/intelmq

[qasidali861]

Thanks Sebix for this
I unable to find the intelmq file in logrotate.d
I need to create new one, if need to create new one so what will be the format of that file.

Thanks

[sebix]

I unable to find the intelmq file in logrotate.d

How did you install IntelMQ?

I need to create new one, if need to create new one so what will be the format of that file.

This is the expected content: https://github.com/certtools/intelmq/blob/develop/contrib/logrotate/intelmq

[qasidali861]

Thankx Sebix

[qasidali861]

Hi Sebix

I have tried but I am getting error

error: intelmq:1 glob failed for /opt/intelmq/var/lib/bots/file-output/*.txt: No such file or directory

/opt/intelmq/var/lib/bots/file-output/*.txt {
    su intelmq intelmq
    daily
    maxsize 10M
    rotate 60
    notifempty
    compress
    delaycompress
    create 644 intelmq intelmq
    sharedscripts
    postrotate
        sudo -u intelmq /usr/local/bin/intelmqctl --quiet reload file-output
    endscript
}

intelmq file is above in logrotate.d

When I check opt/intelmq

There is no such directory which exist.....

Also tried giving my local directory location but got the same error.

[sebix]

Again: How did you install IntelMQ?

What destination path did you configure for your file output bot?

[qasidali861]

@sebix ?????

[sebix]

I just started an IntelMQ docker container and /opt/intelmq/var/lib/bots/file-output/ exists. So if you don't have /opt/intelmq/var/lib/bots/file-output/*.txt, maybe you never started the file output bot?

It looks like logrotate is installed in the docker image, but does not have the configuration for IntelMQ @waldbauer-certat

[qasidali861]

/opt/intelmq
in opt directory intelmq file does not exist.
My file output bot is running but it's not creating the events file in /opt/intelmq.....

[waldbauer-certat]

Correct @sebix

The IntelMQ Logrotate configuration isnt set in the docker container, but should be more or less pretty easy to deploy, see https://github.com/certtools/intelmq/blob/develop/contrib/logrotate/intelmq.

You'd have to change the user "intelmq" to "root", because the docker container internally doesnt have a user set yet. And pathing looks a bit different in the docker container also.

[sebix]

/opt/intelmq in opt directory intelmq file does not exist. My file output bot is running but it's not creating the events file in /opt/intelmq.....

You need to look inside the intelmq container.

[qasidali861]

Time	ID	Level	Message
2022-11-07T10:28:08.959000	file-output	INFO	File '/opt/intelmq/var/lib/bots/file-output/events.txt' is open.
2022-11-07T10:28:08.720000	file-output	INFO	FileOutputBot initialized with id file-output and intelmq 3.0.2 and python 3.9.2 (default, Feb 28 2021, 17:03:44) as process 2448.
2022-11-07T10:28:08.720000	file-output	INFO	Bot is starting.
2022-11-07T10:28:08.240000	file-output	INFO	File '/opt/intelmq/var/lib/bots/file-output/events.txt' is open.
2022-11-07T10:28:08.240000	file-output	INFO	Bot initialization completed.
2022-11-07T10:28:08.005000	file-output	INFO	FileOutputBot initialized with id file-output and intelmq 3.0.2 and python 3.9.2 (default, Feb 28 2021, 17:03:44) as process 2447.
2022-11-07T10:28:08.005000	file-output	INFO	Bot is starting.
2022-11-07T10:28:07.622000	file-output	INFO	Received SIGTERM.
2022-11-07T10:28:07.622000	file-output	INFO	Bot stopped.
2022-11-03T10:04:49.960000	file-output	INFO	File '/opt/intelmq/var/lib/bots/file-output/events.txt' is open.
2022-11-03T10:04:49.960000	file-output	INFO	Bot initialization completed.
2022-11-03T10:04:49.633000	file-output	INFO	FileOutputBot initialized with id file-output and intelmq 3.0.2 and python 3.9.2 (default, Feb 28 2021, 17:03:44) as process 2346.
2022-11-03T10:04:49.633000	file-output	INFO	Bot is starting.
2022-11-03T08:23:50.274000	file-output	INFO	Received SIGTERM.
2022-11-03T08:23:50.274000	file-output	INFO	Bot stopped.
2022-11-03T08:23:10.467000	file-output	INFO	Bot initialization completed.
2022-11-03T08:23:10.466000	file-output	INFO	File '/opt/intelmq/var/lib/bots/file-output/events.txt' is open.
2022-11-03T08:23:10.091000	file-output	INFO	FileOutputBot initialized with id file-output and intelmq 3.0.2 and python 3.9.2 (default, Feb 28 2021, 17:03:44) as process 1937.
2022-11-03T08:23:10.091000	file-output	INFO	Bot is starting.
2022-11-03T07:52:26.246000	file-output	INFO	Bot stopped.
2022-11-03T07:52:26.245000	file-output	INFO	Received SIGTERM.
2022-10-24T09:50:24.781000	file-output	INFO	File '/opt/intelmq/var/lib/bots/file-output/events.txt' is open.
2022-10-24T09:50:24.781000	file-output	INFO	Bot initialization completed.
2022-10-24T09:50:23.763000	file-output	INFO	Bot is starting.
2022-10-24T09:50:23.762000	file-output	INFO	FileOutputBot initialized with id file-output and intelmq 3.0.2 and python 3.9.2 (default, Feb 28 2021, 17:03:44) as process 267.
2022-10-24T09:47:32.135000	file-output	INFO	Bot initialization completed.
2022-10-24T09:47:32.134000	file-output	INFO	File '/opt/intelmq/var/lib/bots/file-output/events.txt' is open.
2022-10-24T09:47:31.228000	file-output	INFO	Bot is starting.
2022-10-24T09:47:31.226000	file-output	INFO	FileOutputBot initialized with id file-output and intelmq 3.0.2 and python 3.9.2 (default, Feb 28 2021, 17:03:44) as process 274.

These are logs from file-output bot.

[qasidali861]

SS of bot