LSWS security_audit.log growing to 35GB+

ordinary

I'm currently on 12.20 with OLS + cPGuard.

Over the past couple of days I noticed performance slowdowns across app servers in my cluster.

I tracked it back to sustained IO pressure and discovered "/usr/local/lsws/logs/security_audit.log" was growing without rotation since late March (around the time I updated Enhance). I truncated the 35GB+ file but it's still growing.

Has anyone else experienced this issue? How should I correctly configure logrotate for this file so it survives future updates?

Thanks!

ordinary

Update: Looks like I also needed to switch cpGuard to iptables: https://www.opsshield.com/blog/cpguard-firewall-enhanced-performance-with-iptables-new-features/

I missed this post. Seems to be helping on the performance front, still monitoring though.