# \#762: Add eof line to logfiles

**URL:** <https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205>\
**Category:** Development\
**Tags:** development\
**Created:** [January 31, 2012, 1:13am UTC](https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205 "2012-01-31T01:13:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\
**Post date:** [January 31, 2012, 1:13am UTC](https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205/1 "2012-01-31T01:13:29Z")

</div>

AFAIK, RFC 4180 doesn't specify comments as part of standard CSV format. Thus, I believe it's important to ensure that an option to disable this behavior makes it into the code.

--Gilbert

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [January 31, 2012, 1:22am UTC](https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205/2 "2012-01-31T01:22:11Z")

</div>

It would not be CSV compatible, that is true… but Bro already uses the same format for its header lines (which also are not RFC 4180 conformant unless I am very much mistaken).

Can those be switched off by a configuration option? If yes one could use the same one for the footer line...

---

<div class="post-metadata">

**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\
**Post date:** [January 31, 2012, 1:27am UTC](https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205/3 "2012-01-31T01:27:47Z")

</div>

Nope, the headers aren't RFC spec, either. IIRC, the option to disable these headers is (from scripts/base/frameworks/logging/writers/ascii.bro):

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;## If true, include a header line with column names and description  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;## of the other ASCII logging options that were used.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const include\_header = T &redef;

Thus, `include_footer` seems like it'd be sane to me.

--Gilbert

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [January 31, 2012, 5:20am UTC](https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205/4 "2012-01-31T05:20:04Z")

</div>

Or just rename into a single one like "include\_format"

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/762-add-eof-line-to-logfiles/2205/5 "2022-05-06T15:40:09Z")

</div>