Messages

Thanks, but I don't rely on local log retention.
My setup includes a centralized logging system cluster with redundancy – if one SIEM node fails, another one takes over. Logs are streamed live via UDP, so there's no need to store old logs locally.

That's exactly why I use a RAM disk for /var/log: to minimize wear on the NVMe and avoid unnecessary local writes.

The issue is not about log availability – it's about Suricata ignoring the log rotation and retention settings, which causes the RAM disk to fill up.

Thank you for sharing