Page 1 of 1

events deleted from web gui take longer than expected to be deleted from filesystem

Posted: Mon Apr 04, 2016 8:54 pm
by thermionic
1.2.9 on a clean install of Ubuntu 14.04

RUN_AUDIT is ticked
AUDIT_CHECK_INTERVAL is set to 900

I haven't timed it, but it looks more like 15 hours before events are deleted from disk rather than 15 minutes

Have I misunderstood the documentation ?

Cheers

Re: events deleted from web gui take longer than expected to be deleted from filesystem

Posted: Mon Apr 04, 2016 9:35 pm
by bbunge
Depends. AUDIT_MIN_AGE = 86400 or 24 hours. So, if what you are trying to remove is younger than 24 hours it will remain until it ages.

Re: events deleted from web gui take longer than expected to be deleted from filesystem

Posted: Mon Apr 04, 2016 10:40 pm
by thermionic
<facepalm>

apologies, I had completely missed that in the docs, twice...

thanks!

Re: events deleted from web gui take longer than expected to be deleted from filesystem

Posted: Mon Apr 04, 2016 11:48 pm
by bbunge
Actually, I had to look that one up so I learned something, too!!! 8)