# bro\_log\_file and log\_hook

**URL:** <https://community.zeek.org/t/bro-log-file-and-log-hook/958>\
**Category:** Zeek\
**Created:** [April 28, 2006, 1:57pm UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958 "2006-04-28T13:57:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Alexander](https://avatars.discourse-cdn.com/v4/letter/c/3da27b/32.png) [@Chris\_Alexander](https://community.zeek.org/u/Chris_Alexander)\
**Post date:** [April 28, 2006, 1:57pm UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958/1 "2006-04-28T13:57:36Z")

</div>

In trying to turn off stderr spraying to the screen I found something that doesn't seem to provide enough info - or maybe I'm having a senior moment?

I stumbled across this and couldn't figure out how to implement log\_hook in my policy file:

\<[http://www.bro-ids.org/Bro-reference-manual/log-Analysis-Script.html#log-Analysis-Script](http://www.bro-ids.org/Bro-reference-manual/log-Analysis-Script.html#log-Analysis-Script)\>

Trying to find more info I notice it is referring to "bro\_log\_file" but this is not a reference I can find in the html online docs or in the online PDF.

Searching [bro-ids.org](http://bro-ids.org) with google finds one other mention:

\<[http://www.bro-ids.org/Bro-reference-manual/Uncategorized.html](http://www.bro-ids.org/Bro-reference-manual/Uncategorized.html)\>

but does not help me understand the logging much better.

Is there a missing link to a "bro\_log\_file" reference on the site? Grep'ing in the policy dir didn't find any examples of "log\_hook" to copy.

TIA

---

<div class="post-metadata">

**Author:** ![Chris\_Alexander](https://avatars.discourse-cdn.com/v4/letter/c/3da27b/32.png) [@Chris\_Alexander](https://community.zeek.org/u/Chris_Alexander)\
**Post date:** [April 28, 2006, 2:30pm UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958/2 "2006-04-28T14:30:10Z")

</div>

Forgot to add, log\_hook reference at

\<[http://www.bro-ids.org/Bro-reference-manual/Predefined-Functions.html](http://www.bro-ids.org/Bro-reference-manual/Predefined-Functions.html)\>

also seems to reference missing docs.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [April 28, 2006, 4:11pm UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958/3 "2006-04-28T16:11:06Z")

</div>

> In trying to turn off stderr spraying to the screen I found something that  
> doesn't seem to provide enough info - or maybe I'm having a senior moment?

No, you don't. With Bro 0.9a7, there has been a change of names with  
regards to "log", "alert", "alarm", etc. to make their uses more  
consistent/intuitive (see the CHANGES entry for more information).  
The docs haven't been updated yet.

The former "log\_hook" is now called "alarm\_hook". Here's an example:

&nbsp;&nbsp;&nbsp;function alarm\_hook(msg: string): bool  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print "Foo", msg;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return T;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;alarm "Bar";

&nbsp;&nbsp;&nbsp;\> ./bro ./a.bro  
&nbsp;&nbsp;&nbsp;Foo, Bar  
&nbsp;&nbsp;&nbsp;1146240414.805556 Bar

Robin

---

<div class="post-metadata">

**Author:** ![Chris\_Alexander](https://avatars.discourse-cdn.com/v4/letter/c/3da27b/32.png) [@Chris\_Alexander](https://community.zeek.org/u/Chris_Alexander)\
**Post date:** [April 28, 2006, 6:43pm UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958/4 "2006-04-28T18:43:54Z")

</div>

Thanks, Robin. Very helpful.

I've got something working but...

weird.bro gets @load'ed and I end up with lots of weird messages sprayed to the screen.

How do I turn this off via alarm\_hook?

My messages (print via alarm()) work fine but the weird stuff is still spraying. Probably a tidbit I'm missing?

Here's what I've got...ignore whether what is printed makes sense - just playing/learning the lingo.

function alarm\_hook(msg: string): bool  
{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print msg;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return F;  
}

event connection\_established(c: connection)  
{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local id = c$id;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local service = id$resp\_p;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local inbound = is\_local\_addr(id$resp\_h);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( id$resp\_h in mail\_servers )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( inbound && [id$resp\_h, service] !in allowed\_mail\_services )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;alarm fmt("out of scope (mail) : %s", full\_id\_string(c));  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
}

The output looks kinda like:

1146059131.898819 weird: spontaneous\_RST  
1146059132.021314 weird: spontaneous\_RST  
1146059132.942845 weird: unsolicited\_SYN\_response  
1146059132.945050 weird: unsolicited\_SYN\_response  
1146059132.947408 weird: unsolicited\_SYN\_response  
1146059132.949907 weird: unsolicited\_SYN\_response  
out of scope (mail) : 142.92.39.44 ?b ?\>? 142.92.39.129/ssh ?b 0.0s  
1146059132.952414 weird: unsolicited\_SYN\_response  
1146059132.963438 weird: unsolicited\_SYN\_response  
1146059132.966381 weird: unsolicited\_SYN\_response  
1146059133.277703 weird: connection\_originator\_SYN\_ack  
1146059133.313146 weird: data\_before\_established  
1146059133.315934 weird: possible\_split\_routing

with bazillions of weird stderr output. How to eliminate the weird stuff?

TIA!

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [April 29, 2006, 2:24am UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958/5 "2006-04-29T02:24:27Z")

</div>

Can you double-check that weird.bro is loaded? Because when it is,  
the weird messages are supposed to go into weird.log rather than to  
stderr.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-log-file-and-log-hook/958/6 "2022-05-06T15:37:51Z")

</div>