# Bro logs - enable\_local\_logging and remove\_default\_filter **URL:** \ **Category:** Zeek\ **Created:** [December 13, 2018, 3:25pm UTC](https://community.zeek.org/t/bro-logs-enable-local-logging-and-remove-default-filter/5558 "2018-12-13T15:25:04Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Hovsep\_Levi](https://avatars.discourse-cdn.com/v4/letter/h/977dab/32.png) [@Hovsep\_Levi](https://community.zeek.org/u/Hovsep_Levi)\ **Post date:** [December 13, 2018, 3:25pm UTC](https://community.zeek.org/t/bro-logs-enable-local-logging-and-remove-default-filter/5558/1 "2018-12-13T15:25:04Z")
Hi all, Can you please help to explain how to disable local logging ? I am using the KafkaWriter Bro plugin for many years now without a problem but after an upgrade to Bro 2.6 there is a problem. The logs that are excluded from sending to Kafka are the logs that are being written to disk. In Bro config language that means the logs that are not explicitly defined in KafkaLogger::logs\_to\_send. Example from local.bro for KafkaLogger: redef KafkaLogger::logs\_to\_send( CaptureLoss::LOG, etc… ) Historically I modify the KafkaLogger plugin slightly to support disabling the writing of logs to disk by adding a function call to “Log::remove\_default\_filter” for each log. With Bro 2.6 this no longer seems to work the way it once did. So I check the documentation at [https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.bro.html](https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.bro.html) and see remove\_default\_filter still exists and also notice two variables that might be relevant to my issue. > [`Log::enable_local_logging`](https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.bro.html#id-Log::enable_local_logging): [`bool`](https://www.bro.org/sphinx-git/script-reference/types.html#type-bool) [`&redef`](https://www.bro.org/sphinx-git/script-reference/attributes.html#attr-&redef) | If true, local logging is by default enabled for all filters. | > > - | - | > [`Log::enable_remote_logging`](https://www.bro.org/sphinx-git/scripts/base/frameworks/logging/main.bro.html#id-Log::enable_remote_logging): [`bool`](https://www.bro.org/sphinx-git/script-reference/types.html#type-bool) [`&redef`](https://www.bro.org/sphinx-git/script-reference/attributes.html#attr-&redef) | If true, remote logging is by default enabled for all filters. | But when I try to set Log::enable\_local\_logging=0 within the KafkaLogger plugin loop for each log I get an error. Thanks in advance. -Hovsep ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [December 13, 2018, 9:51pm UTC](https://community.zeek.org/t/bro-logs-enable-local-logging-and-remove-default-filter/5558/2 "2018-12-13T21:51:08Z")
Hi Hovsep, [...] > Historically I modify the KafkaLogger plugin slightly to support disabling > the writing of logs to disk by adding a function call to > "Log::remove\_default\_filter" for each log. With Bro 2.6 this no longer > seems to work the way it once did. I just looked and I did not really see any big way in which this changed. Could you perhaps provide a code-snippet that does not work anymore? I also just tried a minimal example script and Log::remove\_default\_filter seems to work as expected. [...] > But when I try to set Log::enable\_local\_logging=0 within the KafkaLogger > plugin loop for each log I get an error. This is probably a misunderstanding. Log::enable\_local\_logging is not a per-log setting - so there is nothing to loop over. If you do a redef Log::enable\_local\_logging = F; The setting will persist. That being said, you will very probably not want to enable this, it means something slightly different than what you expect. Remote logging means that a log is sent to a remote Bro instance; local logging means that logging is performed by the current node. If you set enable\_local\_logging to false on a node, it will not output any kind of logs directly itself - this includes sending logs to Kafka - from a Bro point of view, these are local logs (the logging is performed by the local node). By default this is set to "T" in standalone mode; in clusters the setting is "T" on Logger nodes and "F" on all other nodes. Which is very probably like you want it. I hope this helps, Johanna ---
**Author:** ![Hovsep\_Levi](https://avatars.discourse-cdn.com/v4/letter/h/977dab/32.png) [@Hovsep\_Levi](https://community.zeek.org/u/Hovsep_Levi)\ **Post date:** [December 18, 2018, 9:18pm UTC](https://community.zeek.org/t/bro-logs-enable-local-logging-and-remove-default-filter/5558/3 "2018-12-18T21:18:36Z")
> I just looked and I did not really see any big way in which this changed. > Could you perhaps provide a code-snippet that does not work anymore? I modify the KafkaLogger script (logs-to-kafka.bro) and add Log::remove\_default\_filter before the call to Log::add\_filter. > I also just tried a minimal example script and Log::remove\_default\_filter > seems to work as expected. It works for some of the logs except: ls -l bro/logs/current/ total 511992 -rw-r–r-- 1 bro bro 1032325 Dec 18 07:15 broker.log -rw-r–r-- 1 bro bro 666385163 Dec 18 07:15 conn.log -rw-r–r-- 1 bro bro 12994 Dec 18 07:15 dce\_rpc.log -rw-r–r-- 1 bro bro 223181005 Dec 18 07:15 files.log -rw-r–r-- 1 bro bro 5780 Dec 18 07:15 smb\_files.log -rw-r–r-- 1 bro bro 3283 Dec 18 07:15 smb\_mapping.log -rw-r–r-- 1 bro bro 5077483 Dec 18 07:15 stderr.log -rw-r–r-- 1 bro bro 187 Dec 13 14:45 stdout.log > […] > > > But when I try to set Log::enable\_local\_logging=0 within the KafkaLogger > > plugin loop for each log I get an error. > > This is probably a misunderstanding. Log::enable\_local\_logging is not a > per-log setting - so there is nothing to loop over. Ok, thanks. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-logs-enable-local-logging-and-remove-default-filter/5558/4 "2022-05-06T15:46:14Z")