[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Tripwire reports



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 08 Feb 2003 20:10:08 +1000, Tony Nugent wrote:

> On Sat Feb 08 2003 at 10:38, Michael Schwendt wrote:
> 
> > On Fri, 7 Feb 2003 20:22:30 -0600, Mike Vanecek wrote:
> > 
> > > After a while, tripwire reports will start to build up in
> > > /var/lib/tripwire/report/.  Does anyone have a crontab script or other scheme
> > > for removing the old ones on a periodic basis?
> > 
> > man find
> 
> (not so helpful imho)
> 
> Why not create some magic in /etc/logrotate.d/tripwire and let
> logrotate do it?  Besides, that's *exactly* what it is designed for.

Because it doesn't make any sense at all. I don't know whether you
are familiar with Tripwire. But there is absolutely no need to
rotate any reports. They have a timestamp hardcoded into the file
name, and hence all reports have a different file name already.
Based on time of last modification or last access it is a trivial
task to expire report files once they become old. Actually, it would
be a one-line "find"-command executed as a cron job. Therefore, "man
find" is the proper pointer, IMHO.

- -- 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+RPgv0iMVcrivHFQRAj34AJsGj3wAO8vvsYyRGMj0VWQ5aiHZwQCffwpg
Xf+XEkM+twjwcViAM6q/T80=
=RD6T
-----END PGP SIGNATURE-----





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]