# Bro IDS logging via Syslog **URL:** \ **Category:** Zeek\ **Created:** [February 27, 2013, 6:51pm UTC](https://community.zeek.org/t/bro-ids-logging-via-syslog/2571 "2013-02-27T18:51:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Ron\_Jenkins](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@Ron\_Jenkins](https://community.zeek.org/u/Ron_Jenkins)\ **Post date:** [February 27, 2013, 6:51pm UTC](https://community.zeek.org/t/bro-ids-logging-via-syslog/2571/1 "2013-02-27T18:51:13Z")
Is there a way to have Bro v2.1 send via Syslog along with a log file? Thanks! Ron Jenkins (SnortCP, VCP (3/4), MCNE, CNE6, MCP,CCNA) **RMJ Consulting, LLC.** “_Bringing Companies and Solutions Together_” Makers of **Active Response System(ARS)** & **Log Siphon** Owner / Senior Architect **Physical Address** 11715 Bricksome Ave STE B-7 Baton Rouge, LA 70816 **Mail Address** 7575 Jefferson Hwy #103 Baton Rouge, LA 70806 **Toll:** 855-448-5214 **Direct**. 225-448-5214 **Fax.** 225-448-5324 **Cell.** 225-931-1632 **Email.** [rjenkins@rmjconsulting.net](mailto:rjenkins@rmjconsulting.net) **Web.** [http://www.rmjconsulting.net](http://www.rmjconsulting.net/) **ARS.** [http://www.rmjars.com](http://www.rmjars.com/) **Log Siphon**. [http://www.logsiphon.com](http://www.logsiphon.com/) **Linkedin.** [http://www.linkedin.com/profile/view?id=28564151&trk=tab\_pro](http://www.linkedin.com/profile/view?id=28564151&trk=tab_pro) ---
**Author:** ![jessebowling](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@jessebowling](https://community.zeek.org/u/jessebowling)\ **Post date:** [February 27, 2013, 7:53pm UTC](https://community.zeek.org/t/bro-ids-logging-via-syslog/2571/2 "2013-02-27T19:53:38Z")
There is almost certainly a better way to do it within the Bro framework itself, but another option might be to use built in (?) rsyslog: [http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html](http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html) About halfway down there are instructions for using rsyslog’s imfile module to syslog Bro’s logs… Cheers, Jesse ---
**Author:** ![Ron\_Jenkins](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@Ron\_Jenkins](https://community.zeek.org/u/Ron_Jenkins)\ **Post date:** [February 27, 2013, 7:56pm UTC](https://community.zeek.org/t/bro-ids-logging-via-syslog/2571/3 "2013-02-27T19:56:05Z")
Thank you for the response! I just completed setting syslog-ng and now have the log files sending via syslog to Log Siphon now. I agree, that it would be great to have it built into the framework directly. Have a good day! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/bro-ids-logging-via-syslog/2571/4 "2022-05-06T15:40:48Z")