next up previous contents index
Next: The active Module Up: Analyzers and Events Previous: The mt Module   Contents   Index


The log Module

The log utility module redefines a single variable:

[bro_log_file : file] A special Bro variable used internally to specify a file where Bro should record messages logged by log statements (as well as generating real-time alerts via syslog).

Default: if the $BRO_ID environment variable is defined, then log.<$BRO_ID>, otherwise bro.log.

Note: This value is slightly different than that returned by open_log_file, because the latter would return log if $BRO_ID wasn't defined, and that name seems too easy to confuse with other uses.

See §  for further discussion.

If you do not include this module, then Bro records log messages to stderr.

Figure: Sample definition of log_hook
\begin{figure}\begin{verbatim}global msg_count: table[string] of count &defaul...
... schedule +5 min { log_summary(msg) };return F;
}\end{verbatim}
\end{figure}

You can also control Bro's log processing by defining the special function log_hook. It takes a single argument, msg: string, the message in a just-executed log statement, and returns a boolean value: true if Bro should indeed log the message, false if not. For example, Figure [*] shows a definition of log_hook that checks each log message to see whether the same text has been logged before. It only logs the first instance of a message. If a message appears at least five times, then it schedules a future log_summary event for 5 minutes in the future; the purpose of this event is to summarize the total number of times the message has appeared at that point in time.


next up previous contents index
Next: The active Module Up: Analyzers and Events Previous: The mt Module   Contents   Index
Vern Paxson 2004-03-21