search

farsightsec / fstrm

Frame Streams implementation in C
MIT License
59 stars 27 forks source link

fstrm_capture split based file size #64

Closed davehouser1 closed 2 years ago

davehouser1 commented 3 years ago

I know fstrm_capture can rotate output files based on a split time. Is it possible to rotate files based on file size?

Example: When file reached 5MB, stop writing to one file, and start writing to another.

If not, is there any plan to do this in the future?

cmikk commented 3 years ago

fstrm_capture does not have this feature, but we will consider this a feature request for a future release. In the interim, I would suggest using logrotate or similar with _fstrmcapture's SIGUSR1 rotation feature.

Note that this rotation approach may interact poorly with the timestamp-based filenames of _fstrmcapture's built-in file rotation, if the file size limit is exceeded within the resolution of the file name's format, so this feature (if implemented) should be used with care.

davehouser1 commented 3 years ago

Have considered using logrotate, however I have concerns that some data will will be lost during the rotation, is this cause for concern or a possibility? or as much of a possibility as how fstrm rotates by split time?

cmikk commented 3 years ago

Loss during rotation should not be a concern. fstrm_capture will continue writing to the file after logrotate moves it, and will flush output to the file before closing it.