# cluster manager log buffering

**URL:** <https://community.zeek.org/t/cluster-manager-log-buffering/1563>\
**Category:** Zeek\
**Created:** [December 17, 2009, 9:27pm UTC](https://community.zeek.org/t/cluster-manager-log-buffering/1563 "2009-12-17T21:27:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Justin\_Azoff](https://avatars.discourse-cdn.com/v4/letter/j/eb9ed0/32.png) [@Justin\_Azoff](https://community.zeek.org/u/Justin_Azoff)\
**Post date:** [December 17, 2009, 9:27pm UTC](https://community.zeek.org/t/cluster-manager-log-buffering/1563/1 "2009-12-17T21:27:40Z")

</div>

Hi all,

I'm working on setting up a single node multi-core bro cluster, and I think I  
finally got everything working, except that logs are being buffered on the  
manager no matter what I do.

I tried hacking File.cc to change buffered=false,  
I tried loading file-flush,  
nothing seems to help.

What I'm seeing is that for quiet log files, records are taking about 10  
minutes to show up.

The interesting thing is that alarm.log, mail.log, and notice.log are somehow treated differently, and are not being buffered.

How exactly does a print statement in a worker get turned into a file write  
call on the manager?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/cluster-manager-log-buffering/1563/2 "2022-05-06T15:38:59Z")

</div>