Versions up to 1.9.4 do not do any log management whatsoever, and will fill-disk if not managed by something else like RMM.
Proposed fix in RC/upcoming releases is to switch from time-based rollover (which is apparently bugged) to size based rollover.
In the version I was provided (1.10.2), the logging defaults are as follows:
LogLevel: DEBUG
Log size: 100MB
Logs retained 10
This means that the agent is both overlogging (DEBUG is not a sane default log level folks!) and being allowed to retain 1000MB of logs.
Please configure
default logging options. My suggestion would be:
  • Implement a log library like NLOG if your 2018 version of LOG4NET can't do basic log rotation. In the interim,
  • Set default log level to INFO. DEBUG should only be enabled in the context of troubleshooting an active case.
  • Set log rotation/retention to something reasonable; I would suggest that something like DNSFilter should not be retaining more that 50MB of log data.