bro-dblogger

Zeek
1

Hi all,

Here's my first functional release of a tool for inserting data from Bro into a PostgreSQL database in realtime. There are still quite a few things to work on, but this version works and is already being used here.

Site at github: http://github.com/sethhall/bro-dblogger
Zip: http://github.com/sethhall/bro-dblogger/zipball/release1
Tar.gz: http://github.com/sethhall/bro-dblogger/tarball/release1

Check out the README and the examples directory if you are interested in using it. If you have any questions or comments, please let me know.

Thanks!
   .Seth

2

I forgot to mention that in order to use this, you'll need to be linking against the version of Broccoli in trunk or broccoli from the soon-to-be 1.4 release.

   .Seth

3

Seth Hall wrote:

I forgot to mention that in order to use this, you'll need to be
linking against the version of Broccoli in trunk or broccoli from the
soon-to-be 1.4 release.

I'm getting compile time error:

c++ -g -Wall -I/usr/local/include -L/usr/local/lib
-L/usr/local/lib/postgresql -I/usr/local/include/postgresql
-L/usr/local/bro14/lib -I/usr/local/bro14/include -lbroccoli -lpq
bro-dblogger.cc -o bro-dblogger
bro-dblogger.cc: In function 'void db_log_event_handler(BroConn*, void*,
BroEvMeta*)':
bro-dblogger.cc:281: error: 'bro_record_get_nth_name' was not declared
in this scope
*** Error code 1

   .Seth

--mel

4

Oh, I guess I forgot to mention that it will only work with the upcoming 1.4 final (or current trunk). That was a small update that was included after the 1.4 pre-releases. Sorry about that!

   .Seth