Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Is there documentation on rotating the filesystem results.log file on a Fleet server? I can use the Debian `logrotate` but want to make sure I'm doing it in a way that won't result in data loss. Whatever threshold is built in is much too slow.

Hi Shawn! You can change this in the server configuration: <https://fleetdm.com/docs/configuration/fleet-server-configuration#filesystem-max-age>

The docs say that's how long old files are kept. If I read that correctly, if rotation is enabled, it's hardcoded to rotate 28 days (or 500 MB) and the rotated files will be kept for `filesystem​_max​_age` days before deletion.

28 days and 500 MB is the default, this overrides those values.

I changed it to `1` and that's not what happened. All results older than a day were purged.

&gt; MaxAge is the maximum number of days to retain old log files based on the timestamp encoded in their filename.  Note that a day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc. The default is not to remove old log files based on age.

I think this is what I want:
> The logFile can be rotated by sending a `SIGHUP` signal to Fleet if enableRotation is true
<https://github.com/fleetdm/fleet/blob/56a8bc03a86040fbc033213d9a481d3dcc8f0677/server/logging/filesystem.go#L27-L28>

I think I misunderstood your question - are you looking to preserve the older log files but move the flow to a new file?

I want the log files to be rotated more often

To amend my previous statement: a log file is used until the max size is reached, and then rotation happens and a new log file is created. What I think you'd want to do is set the max size lower if you're looking for a more frequent rotation of the *active* log file.

I think I'm just going to switch to the webhook logger plugin, so I don't have to write my own log forwarder.

I was originally hoping to use an existing tool like Grafana Alloy but it does too much processing before shipping the data. Then I was going to `rsync` any rotated logs, but that would require frequent file rotation.

Makes sense to me, and I'm glad you have a path forward! I filed a FR for time-based log rotation here: <https://github.com/fleetdm/fleet/issues/44523>