# changing log output

**URL:** <https://community.zeek.org/t/changing-log-output/4466>\
**Category:** Zeek\
**Created:** [November 3, 2016, 10:36pm UTC](https://community.zeek.org/t/changing-log-output/4466 "2016-11-03T22:36:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Ives](https://avatars.discourse-cdn.com/v4/letter/j/a5b964/32.png) [@John\_Ives](https://community.zeek.org/u/John_Ives)\
**Post date:** [November 3, 2016, 10:36pm UTC](https://community.zeek.org/t/changing-log-output/4466/1 "2016-11-03T22:36:48Z")

</div>

I'm trying to configure bro to work within some proposed privacy  
policies. For example, one of the things we may not be allowed to store  
is the http traffic logs. I want bro to still know (internally) what is  
happening in these streams so that it can use it for other functions  
(like sqli detection which loads http), just not output the normal logs.  
I had thought to do this through Notice::ignored\_types  
in local.bro, however the following is still outputting the http.log file.

redef Notice::ignored\_types += {  
&nbsp;&nbsp;SSL::Invalid\_Server\_Cert,  
&nbsp;&nbsp;HTTP::LOG,  
};

Additionally, I suspect that while this method (if I get it to work) may  
result in sqli notices, I am not sure it will result in me getting the  
attack data. For example, if a sqli attack is detected, I would like the  
http.log style string to be output to a file.

Any suggestions on how first to prevent the http.log file creation and  
then make sure the offending traffic is recorded for detect-sqli.bro?

Yours,

John

---

<div class="post-metadata">

**Author:** ![Lamps\_Jereme](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@Lamps\_Jereme](https://community.zeek.org/u/Lamps_Jereme)\
**Post date:** [November 3, 2016, 10:56pm UTC](https://community.zeek.org/t/changing-log-output/4466/2 "2016-11-03T22:56:49Z")

</div>

This will do it for you I think:

event bro\_init() {  
Log::disable\_stream(HTTP::LOG);  
}

Jereme

On 11/3/16, 4:36 PM, "[bro-bounces@bro.org](mailto:bro-bounces@bro.org) on behalf of John Ives"

---

<div class="post-metadata">

**Author:** ![John\_Ives](https://avatars.discourse-cdn.com/v4/letter/j/a5b964/32.png) [@John\_Ives](https://community.zeek.org/u/John_Ives)\
**Post date:** [November 3, 2016, 11:30pm UTC](https://community.zeek.org/t/changing-log-output/4466/3 "2016-11-03T23:30:30Z")

</div>

Jereme,

Thank you very much that seems to have done the trick for disabling the  
http.log.

John

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/changing-log-output/4466/4 "2022-05-06T15:44:15Z")

</div>