The log Module
Keywords: doc-html

Next: The active Module Up: Analyzers and Events Previous: The mt Module Contents Index

#
The `log` Module

The `log` utility module redefines a single variable:

  [``bro_log_file : file``] A special Bro variable used internally to specify a file where Bro should record messages logged by `log` statements (as well as generating real-time alerts via syslog).

  Default: if the `$BRO_ID` environment variable is defined, then `log.`<`$BRO_ID`>``, otherwise `bro.log`.

  Note: This value is slightly different than that returned by `open_log_file`, because the latter would return `log` if `$BRO_ID` wasn't defined, and that name seems too easy to confuse with other uses.

  See § for further discussion.

If you do not include this module, then Bro records log messages to stderr.

Figure 7.4: Sample definition of `log_hook`

You can also control Bro's log processing by defining the special function `log_hook`. It takes a single argument, `msg: string`, the message in a just-executed `log` statement, and returns a boolean value: true if Bro should indeed log the message, false if not. For example, Figure 7.9 shows a definition of `log_hook` that checks each log message to see whether the same text has been logged before. It only logs the first instance of a message. If a message appears at least five times, then it schedules a future `log_summary` event for 5 minutes in the future; the purpose of this event is to summarize the total number of times the message has appeared at that point in time.

Next: The active Module Up: Analyzers and Events Previous: The mt Module Contents Index