# Change location of log files?

**URL:** https://community.zeek.org/t/change-location-of-log-files/5010
**Category:** Zeek
**Created:** [September 1, 2017, 1:34pm UTC](https://community.zeek.org/t/change-location-of-log-files/5010 "2017-09-01T13:34:07Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![craig\_bowser](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@craig\_bowser](https://community.zeek.org/u/craig_bowser)
#### Post date: [September 1, 2017, 1:34pm UTC](https://community.zeek.org/t/change-location-of-log-files/5010/1 "2017-09-01T13:34:07Z")

</div>

I’ve been looking thru the docs, but I don’t see ( and perhaps I don’t understand) if there is an option to change the location where bro writes all the log files.

The default is /usr/local/bro/logs and I would like them to be written to a partition I created called /data

/usr/local/bro/logs/current can stay where it is, but I’d like everything else to be moved.

Thanks

Craig

---

<div class="post-metadata">

### Author: ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)
#### Post date: [September 1, 2017, 2:00pm UTC](https://community.zeek.org/t/change-location-of-log-files/5010/2 "2017-09-01T14:00:20Z")

</div>

In broctl.cfg...

logdir = /usr/local/bro/logs

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

### Author: ![Maerz\_Stefan\_A](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Maerz\_Stefan\_A](https://community.zeek.org/u/Maerz_Stefan_A)
#### Post date: [September 1, 2017, 2:05pm UTC](https://community.zeek.org/t/change-location-of-log-files/5010/3 "2017-09-01T14:05:43Z")

</div>

Broctl.conf file has a logging location. Scroll down to find it. Default place for it is /usr/local/bro/etc/broctl.conf

You can specify where both the current and rotated data is stored separately. This is what I have, the defaults are commented out:

# Location of the log directory where log files will be archived each rotation

# interval.

##LogDir = /usr/local/bro/logs  
LogDir = /data/log

# Location of the spool directory where files and data that are currently being

# written are stored.

##SpoolDir = /usr/local/bro/spool  
SpoolDir = /data/spool

Best Regards,  
-Stefan

---

<div class="post-metadata">

### Author: ![craig\_bowser](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@craig\_bowser](https://community.zeek.org/u/craig_bowser)
#### Post date: [September 1, 2017, 3:13pm UTC](https://community.zeek.org/t/change-location-of-log-files/5010/4 "2017-09-01T15:13:47Z")

</div>

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/change-location-of-log-files/5010/5 "2022-05-06T15:45:15Z")

</div>