Skip to content

some old log files are not pruned correctly #855

@mmguero

Description

@mmguero

clean-processed-folder.py in the filebeat container has the job of removing old Log files once they've been processed.

I discovered two problems:

  1. Windows Event file archives (evtx) are not cleaned due to their MIME type being too generic (application/octet-stream)
  2. Some Zeek logs can smell like HTML files (e.g., HTML document, ASCII text, with very long lines, text/html)

We need to handle these two cases.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

Status

Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions