pcap log rotation for connection log quota

Question

david415 opened this issue 10 years ago · 4 comments

We do indeed need a way to enforce an on-disk quota of pcap logs per each connection tracked. A log rotation scheme can easily accomplish this goal.

Answer 1 · 2015-05-25T23:41:59.000Z

work in progress:

here's a rough quota enforced Writer using a log rotation scheme:
346babd

It just occurred to me that each new pcap file will need the appropriate pcap header written to the beginning...

Answer 2 · 2015-05-26T20:23:55.000Z

so far i've made numerous bug fixes to the dev branch... and it seems to work now:
https://github.com/david415/HoneyBadger/tree/62-rotating-pcap

Answer 3 · 2015-05-29T04:47:44.000Z

reopening... due to reverting several bad commits... we are going to reapply these changes or make similar new ones.

Answer 4 · 2015-05-29T19:54:21.000Z

fixed... finally!