# Changing logging defaults **URL:** \ **Category:** Zeek\ **Created:** [July 2, 2019, 12:48pm UTC](https://community.zeek.org/t/changing-logging-defaults/5752 "2019-07-02T12:48:46Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Ambros\_Novak](https://avatars.discourse-cdn.com/v4/letter/a/9fc29f/32.png) [@Ambros\_Novak](https://community.zeek.org/u/Ambros_Novak)\ **Post date:** [July 2, 2019, 12:48pm UTC](https://community.zeek.org/t/changing-logging-defaults/5752/1 "2019-07-02T12:48:46Z")
Good Day, I’m running an older version of Bro and would like to change some default logging options using the local.bro. For example, in trying to change DNS’s rejected to T because it’s defaulted to F. I’m able to change it in the module file, but I would rather do it in local.bro. Thanks you for the assistance. Ambros ---
**Author:** ![Adam\_Pumphrey](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Adam\_Pumphrey](https://community.zeek.org/u/Adam_Pumphrey)\ **Post date:** [July 2, 2019, 7:26pm UTC](https://community.zeek.org/t/changing-logging-defaults/5752/2 "2019-07-02T19:26:19Z")
Hey Ambros You can use Filters in local.zeek (local.bro in your case) to customize many of Zeek's default logging options. A "default" filter is applied to each log stream, you have the option to customize the default filter or remove it and add a new one (or add multiple filters). That's all done inside of a zeek\_init() event handler. To learn more I suggest reading this [https://docs.zeek.org/en/stable/frameworks/logging.html#filters](https://docs.zeek.org/en/stable/frameworks/logging.html#filters) and checking out this blog post [https://blog.zeek.org/2012/02/filtering-logs-with-bro.html](https://blog.zeek.org/2012/02/filtering-logs-with-bro.html) (its old but still relevant). To manipulate field values, or add new ones, you'll need to use the appropriate event handlers. This is one of those "it depends" situations. In many cases you can use a protocol's log\_\* event (log\_dns for example) to do what you need but, depending on the situation, there may be others that are a better fit. I caution against modifying the values of built-in fields unless you have a compelling reason to do so though. Take the "rejected" field in the DNS stream for example, it tells you whether the DNS server refused to respond to a client request for policy reasons. It only gets set to T if the server actually rejected the query; in other words "not rejected" is assumed unless the server says otherwise. That said, why would you need to change the value? Maybe you're actually trying to filter which DNS events get logged? If so, you can accomplish that using the Filters I mentioned above with a predicate (pred) function. Take a look at this for more info [https://docs.zeek.org/en/stable/frameworks/logging.html#filter-log-records](https://docs.zeek.org/en/stable/frameworks/logging.html#filter-log-records). Hope that helps. Adam ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/changing-logging-defaults/5752/3 "2022-05-06T15:46:36Z")
Closed on May 6, 2022, 3:46pm UTC