Skip to content

Rotation and Retention

Offline NDJSON rotation is circular and index-based.

How Rotation Works

When rotation is enabled, the writer rolls over before the next write would exceed max_size_mb.

Instead of timestamped files, the runtime uses indexed files such as:

connections.0.ndjson
connections.1.ndjson
connections.2.ndjson

With max_files: 3, the index wraps and overwrites the oldest numbered file:

connections.0.ndjson
connections.1.ndjson
connections.2.ndjson
connections.0.ndjson

Configuration

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  rotation_enabled: true
  max_size_mb: 100
  max_files: 10

What to Expect

  • retention is bounded by max_files * max_size_mb
  • old content is overwritten when the index wraps
  • this is not timestamp rotation
  • directory targets produce indexed connections.N.ndjson files during rotation

Info

If you need long-term retention, ship rotated files elsewhere before the circular index wraps.