# changing conn logging to SQLite

**URL:** <https://community.zeek.org/t/changing-conn-logging-to-sqlite/6087>\
**Category:** Zeek\
**Created:** [April 11, 2020, 3:19pm UTC](https://community.zeek.org/t/changing-conn-logging-to-sqlite/6087 "2020-04-11T15:19:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdella\_Battou](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Abdella\_Battou](https://community.zeek.org/u/Abdella_Battou)\
**Post date:** [April 11, 2020, 3:19pm UTC](https://community.zeek.org/t/changing-conn-logging-to-sqlite/6087/1 "2020-04-11T15:19:45Z")

</div>

I am new to Zeek and I would like to redist the conn logging to SQLite. The documentation says that this is natively supported.

I found this filter “sqlite-conn-filte.zeek” in one of the post

event zeek\_init()  
{  
local filter: Log::Filter =  
[  
$name=“sqlite”,  
$path="/var/db/conn",  
$config=table([“tablename”] = “conn”),  
$writer=Log::WRITER\_SQLITE  
];

Log::add\_filter(Conn::LOG, filter);  
}

my question is where to put (which directory) ? and do I need to invoke it somewhere ?

cheers,  
Abdella

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [April 15, 2020, 12:32am UTC](https://community.zeek.org/t/changing-conn-logging-to-sqlite/6087/2 "2020-04-15T00:32:31Z")

</div>

Where you put that depends on how you run/deploy Zeek, but the usual  
way involving ZeekControl means you could just add it to the end of  
your local.zeek file which gets installed by default (if built from  
source) at /usr/local/zeek/share/zeek/site/local.zeek

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/changing-conn-logging-to-sqlite/6087/3 "2022-05-06T15:47:12Z")

</div>

Closed on May 6, 2022, 3:47pm UTC