# A question about long-connections

**URL:** <https://community.zeek.org/t/a-question-about-long-connections/6874>\
**Category:** Zeek\
**Created:** [January 4, 2023, 9:27am UTC](https://community.zeek.org/t/a-question-about-long-connections/6874 "2023-01-04T09:27:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cindystudyeveryday](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@cindystudyeveryday](https://community.zeek.org/u/cindystudyeveryday)\
**Post date:** [January 4, 2023, 9:27am UTC](https://community.zeek.org/t/a-question-about-long-connections/6874/1 "2023-01-04T09:27:42Z")

</div>

I installed zeek-long-connections on Centos. The result is as following:

 ![image](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/699bb3488f3f12ca67597945c63ce679344c644f.png)  
Field “orig\_bytes” is cumulative. But I hope the separate data.  
The original result looks like: In the first time period [0,t], value of orig\_bytes is a1,in the second time period [0,2_t], value of orig\_bytes is a2.  
The result I hope is like: In the first time period [0,t], value of orig\_bytes is a1,in the second time period [0,2_t], value of orig\_bytes is a2-a1.  
Is there any suggestions for this effect? Thank you.

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [January 6, 2023, 12:55pm UTC](https://community.zeek.org/t/a-question-about-long-connections/6874/2 "2023-01-06T12:55:29Z")

</div>

> Is there any suggestions for this effect? Thank you.

The following uses the log policy hooks to do what you want, though there’s some interplay with the normal conn.log due to the re-use of the `Conn::Info` record - I believe it works out though.

```auto
redef record Conn::Info += {
        prev_orig_bytes: count &default=0;
};

hook LongConnection::log_policy(rec: Conn::Info, id: Log::ID, filter: Log::Filter)
        {
        local tmp = rec$orig_bytes;
        rec$orig_bytes = rec$orig_bytes - rec$prev_orig_bytes;
        rec$prev_orig_bytes = tmp;
        }

```

Would maybe be better to add a new `&log` field for the relative value only, but due to the `Conn::Info` reuse that would then also show-up in the normal conn.log.

Maybe that helps a bit.

---

<div class="post-metadata">

**Author:** ![cindystudyeveryday](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@cindystudyeveryday](https://community.zeek.org/u/cindystudyeveryday)\
**Post date:** [February 11, 2023, 8:54am UTC](https://community.zeek.org/t/a-question-about-long-connections/6874/3 "2023-02-11T08:54:42Z")

</div>

Very useful, thank you very much.