compress and rotate logs if persistence enabled

if persistence is enabled, log files, downloads, binaries, etc. will be compressed and rotated
each start / stop of the t-pot service will account for a full rotation cycle if files are not empty
basically the rotation will recycle logs after 30 days, unless the service is stopped / started manually which will cause for a shorter period
This commit is contained in:
Marco Ochse
2017-07-20 20:25:49 +00:00
parent 0dedd4a172
commit 07c3f48894
3 changed files with 134 additions and 22 deletions

View File

@ -0,0 +1,35 @@
/data/conpot/log/conpot.json
/data/conpot/log/conpot.log
/data/cowrie/log/cowrie.json
/data/cowrie/log/cowrie-textlog.log
/data/cowrie/log/lastlog.txt
/data/cowrie/log/ttylogs.tgz
/data/cowrie/downloads.tgz
/data/dionaea/log/dionaea.json
/data/dionaea/log/dionaea.sqlite
/data/dionaea/bistreams.tgz
/data/dionaea/binaries.tgz
/data/dionaea/dionaea-errors.log
/data/elasticpot/log/elasticpot.log
/data/elk/log/*.log
/data/emobility/log/centralsystem.log
/data/emobility/log/centralsystemEWS.log
/data/glastopf/log/glastopf.log
/data/honeytrap/log/*.log
/data/honeytrap/log/*.json
/data/honeytrap/attacks.tgz
/data/honeytrap/downloads.tgz
/data/mailoney/log/commands.log
/data/p0f/log/p0f.json
/data/suricata/log/*.log
/data/suricata/log/*.json
{
su tpot tpot
copytruncate
create 760 tpot tpot
daily
missingok
notifempty
rotate 30
compress
}

View File

@ -10,7 +10,7 @@ RestartSec=5
# Get and set internal, external IP infos, but ignore errors
ExecStartPre=-/usr/share/tpot/bin/updateip.sh
# Clear state from /data
# Clear state or if persistence is enabled rotate and compress logs from /data
ExecStartPre=-/bin/bash -c '/usr/share/tpot/bin/clean.sh off'
# Remove old containers, images and volumes