Environment
- EDR Event Forwarder: 3.8
- EDR Server: 7.6.x
Question
Can the Event Forwarder's log rotation time be modified?
Answer
No, the Event Forwarder's log rotation time is hard coded to 00:00 UTC.
Additional Notes
- Event Forwarder is using lumberjack log rotating package written in Go and the time is included in the package.
- Cron jobs can be added to rotate the logs more often, but continue to rotate at midnight UTC.
Related Content
