Buffered output on logs

Zeek
1

Question for you folks - clearly the logging functionality of Bro is buffered, but will it also be flushed after a certain time has expired as well?

I'm noticing that the alarm output file can have immediate writes, but something like the ssh output file will have 0 bytes until I manually checkpoint the server.

Your thoughts?

Thanks,

-Eric

Eric Wages
COLSA Corporation
Operations Manager, HMT ROC
256-721-0372, ext 110

2

@load file-flush
redef file_flush_interval = 10 sec;

Log files will write to disk every 10 seconds.

   .Seth

3

Excellent! Thanks, Seth! That's just what I needed.

-Eric

Eric Wages
COLSA Corporation
Operations Manager, HMT ROC
256-721-0372, ext 110