# \[Announcement\] Major NSF funding for Bro development **URL:** \ **Category:** Zeek\ **Created:** [August 24, 2010, 11:53pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654 "2010-08-24T23:53:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 24, 2010, 11:53pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/1 "2010-08-24T23:53:06Z")
Some of you folks may remember that back in January we did a survey soliciting input on operational Bro deployments in the hope of attracting funding for Bro. Today, the Bro team is jazzed to announce that the National Science Foundation has awarded a grant of almost $3M to the International Computer Science Institute (ICSI) and the National Center for Supercomputing Applications (NCSA) for extensive Bro development. The funded project aims specifically at addressing much of the feedback that we have received from Bro users over the years. It will enable us to refine many of the rough edges that the system has accumulated over time[\*], improve Bro's performance significantly, and also make it much easier for the community to contribute to the project. For further information, see the joint ICSI/NCSA press release at:     [http://www.ncsa.illinois.edu/News/10/0824NSFawards.html](http://www.ncsa.illinois.edu/News/10/0824NSFawards.html) While we are still in process of planning our next steps, we'd already like to encourage you folks to take an active role in shaping the course of Bro's future development. In response to our earlier survey, many of you have already sent in ideas on what kind of improvements and new functionality you would like to see. If you have further thoughts, feel free to send them either to the list or to Robin personally. Now is also the time to file your favorite Bro quirk with our tracker at [http://tracker.icir.org/bro](http://tracker.icir.org/bro) ... Thanks to everybody who helped make this happen! The Bro Team [\*] Yes, that includes documentation! ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [September 8, 2010, 4:49pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/2 "2010-09-08T16:49:53Z")
> The funded project aims specifically at addressing much of the > feedback that we have received from Bro users over the years. Following up on my earlier mail, I'm also happy to announce that Seth Hall has joined us over here at ICSI to work with us on moving Bro forward. Many of you folks already know Seth very well, as he has been contributing to Bro and the Bro community for a long time. It's great to have him on the core team now. Welcome, Seth! Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [September 8, 2010, 5:45pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/3 "2010-09-08T17:45:09Z")
I wanted to point out too, that I'll try and frequently be in the #bro-ids channel on the Freenode IRC network in case anyone wants to talk or has questions. Thanks! I'm looking forward to making Bro much more prevalent in the network monitoring world. 🙂   Seth ---
**Author:** ![Martin\_Arlitt](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@Martin\_Arlitt](https://community.zeek.org/u/Martin_Arlitt)\ **Post date:** [September 29, 2010, 9:43pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/4 "2010-09-29T21:43:25Z")
hi Robin my intern has finished his project, and has returned to his university. We are still wrapping up the documentation. I'll see him next week at OSDI, so he and I can discuss this in person. If you, Vern or any of the developers happen to be at OSDI, we could have an informal discussion then. We can also plan for a more formal presentation a bit later. thanks Martin ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [September 29, 2010, 9:58pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/5 "2010-09-29T21:58:53Z")
Sounds good, thanks, Martin. I don't think anybody from us will be at OSDI unfortunately but we're looking forward to hear more (doesn't need to be formal in any way, just something like an email summary will already be helpful). Robin ---
**Author:** ![Martin\_Arlitt1](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Martin\_Arlitt1](https://community.zeek.org/u/Martin_Arlitt1)\ **Post date:** [October 22, 2010, 10:44pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/6 "2010-10-22T22:44:37Z")
hi Robin the technical report is now available at: [http://www.hpl.hp.com/techreports/2010/HPL-2010-164.html](http://www.hpl.hp.com/techreports/2010/HPL-2010-164.html) The work has more focus on Apache than Bro, primarily because I couldn't get Sergey access to Bro on a production network. However, he did integrate DataSeries with Bro and ran some tests. I think his work does show that DataSeries has clear benefits for log collection and analysis with these types of applications. There is at least one thing we would do differently if we started over again, and that is to use an in-memory buffer for log entries before writing an extent to disk. Sergey used a temporary file because he was concerned about messing up Apache's memory management, and then followed the same approach when he added DataSeries logging to Bro. Obviously for those familiar with the Bro source, this shouldn't be an issue. if you or anyone else has questions about this, please let me know. thanks Martin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 23, 2010, 2:21am UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/7 "2010-10-23T02:21:48Z")
Hi Martin! I'm really excited about the prospects of integrating DataSeries into Bro. Are the changes to Bro available anywhere? For the benefit of anyone that hasn't found it yet, here's the link to where you can download the DataSeries source code:    [http://tesla.hpl.hp.com/opensource/](http://tesla.hpl.hp.com/opensource/) .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 25, 2010, 3:53pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/8 "2010-10-25T15:53:21Z")
Thanks, Martin! Robin ---
**Author:** ![Martin\_Arlitt1](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@Martin\_Arlitt1](https://community.zeek.org/u/Martin_Arlitt1)\ **Post date:** [October 25, 2010, 4:41pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/9 "2010-10-25T16:41:05Z")
hi Seth the modified source should be available at [http://www.sfu.ca/~sba70/files/dataseries/](http://www.sfu.ca/%7Esba70/files/dataseries/) if there are any issues, please let me know. thanks Martin Seth Hall wrote: ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/announcement-major-nsf-funding-for-bro-development/1654/10 "2022-05-06T15:39:09Z")