3

I was wondering if it is possible to let sysdig run as a background process and rotate the logfile just for an example every time it gets over 100mb or every 7 day?

and is there anyway i could setup a remote server for the sysdig files?
just so i won't have to destroy my ssd instant where my webservers are running?. ( I all ready have a Graylog server running if that could do the job)

Daniel Guldberg Aaes
  • 421
  • 1
  • 7
  • 13

2 Answers2

3

Sysdig developer here.

  1. Yes. Take a look at this blog post https://sysdig.com/sysdig-continuous-capture-with-file-rotation/.

  2. This is not a feature of sysdig yet, so you would have to build your own solution. A way to do it could be extending sysdig through a Lua script (we call them chisels, and you can find more infor at this URL: https://github.com/draios/sysdig/wiki/Chisels%20User%20Guide)

Loris Degioanni
  • 46
  • 1
  • 1. You could integrate this solution into a systemd service file, like it's explained here: https://dotc.om/roll-your-own-sysdig-systemd-start-service/ – Osqui Dec 12 '18 at 22:53
0

For the second question you can use Filebeats (from ELK stack) or similar

Osqui
  • 135
  • 1
  • 8