# Developing my own writer driver **URL:** \ **Category:** Zeek\ **Created:** [January 28, 2015, 5:29pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456 "2015-01-28T17:29:51Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Luis\_Miguel\_Silva](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Luis\_Miguel\_Silva](https://community.zeek.org/u/Luis_Miguel_Silva)\ **Post date:** [January 28, 2015, 5:29pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/1 "2015-01-28T17:29:51Z")
Dear all, I’m brand new to bro (just found out about it and tried yesterday) and I’m very intrigued by its capabilities. The documentation says we can write outputs into databases BUT, as I got to the logging framework documentation, it seems the only “non file based” writer driver available is for sqlite. I’m really interested in using a server based SQL instance (like postgresql, mysql or mariadb) AND a NoSQL service (mongodb or couchdb). Are there any other writer drivers available (even if they are not officially supported / are part of non committed contributions)? If not, can someone give me some pointers on how to develop extra writer drivers? Thank you, Luis Silva ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [January 28, 2015, 6:14pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/2 "2015-01-28T18:14:29Z")
There is a prototype of a postgresql writer in one a branch. However, it is seriously outdated and will not compile with current Bro versions -- it was either based on 2.2 or 2.1. And even for old bro versions it was barely functional. The best way to learn how to write logging writers is probably to take a look at the already existing ones - they are mostly decapsulated from Bro and quite easy to write. Johanna ---
**Author:** ![John\_Green1](https://avatars.discourse-cdn.com/v4/letter/j/e79b87/32.png) [@John\_Green1](https://community.zeek.org/u/John_Green1)\ **Post date:** [January 28, 2015, 6:39pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/3 "2015-01-28T18:39:46Z")
Hi Luis, I had a similar requirement a while back and took a different approach to get my data into Postgres by importing the output from the default text writer. This was largely to keep things as simple as possible on the sensor side. See [https://github.com/j-o-h-n-g/Mortimer/blob/master/broimport.py](https://github.com/j-o-h-n-g/Mortimer/blob/master/broimport.py) The code is quite dirty in places, but might give you some ideas for possible bro\<-\>postgres type mappings. John ---
**Author:** ![Luis\_Miguel\_Silva](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Luis\_Miguel\_Silva](https://community.zeek.org/u/Luis_Miguel_Silva)\ **Post date:** [January 28, 2015, 7:01pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/4 "2015-01-28T19:01:16Z")
Thanks John, that is very useful, though I was trying to avoid using an external import script as that will introduce a delay between the time the events happen and the registers get added to the DB. Also, based on my experience, it can be pretty expensive to run an import script that parses through the data and translates it into insert calls. Are the text writer logs created in append mode? If so, I could potentially have an external process that listens for new lines and adds things “in near realtime”. Out of curisotiy, why didn’t you create a custom writer instead? …simplicity? Thank you! Luis ---
**Author:** ![John\_Green1](https://avatars.discourse-cdn.com/v4/letter/j/e79b87/32.png) [@John\_Green1](https://community.zeek.org/u/John_Green1)\ **Post date:** [January 28, 2015, 7:22pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/5 "2015-01-28T19:22:58Z")
At the time simplicity and I had multiple remote sensors with restricted network connectivity. I would rsync, or physically transfer, the completed logs back to a central postgres server for import and analysis. Real time alerting wasn't that important. Getting the data into Postgres did facilitate the writing of some useful SQL queries to spot odd/malicious behaviour. If I was doing it again I probably investigate using Postgres Foreign Data Wrappers instead. John ---
**Author:** ![Luis\_Miguel\_Silva](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Luis\_Miguel\_Silva](https://community.zeek.org/u/Luis_Miguel_Silva)\ **Post date:** [January 28, 2015, 7:37pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/6 "2015-01-28T19:37:02Z")
Cool! And since you talked about multiple remote sensors, let me ask another question that I’m really curious about… Lets imagine that I have a low end machine capturing traffic and want to send the prefiltered events into a more beefy remote machine for analysis and event capturing. Can I do that? Based on bro’s Input framework, I believe I can redirect an entire tcpdump into it BUT, I want _some_ filtering to happen upfront, though the MAIN processing work should be executed somewhere else. From what I understood ([based on this architectural description](https://www.bro.org/sphinx/cluster/index.html)), my low end computer in charge of the sniffing would run the “manager” code and my beefy machine(s) would run the workers. Is that how I would set things up? And who writes the outputs, is it the workers OR do the workers pass the result back to the manager? Thank you, Luis ---
**Author:** ![Luis\_Miguel\_Silva](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Luis\_Miguel\_Silva](https://community.zeek.org/u/Luis_Miguel_Silva)\ **Post date:** [January 28, 2015, 8:42pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/7 "2015-01-28T20:42:12Z")
I realized my last question was off topic from the original topic so I’m going to create a new thread for it. Thank you! Luis ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/developing-my-own-writer-driver/3456/8 "2022-05-06T15:42:24Z")
Closed on May 6, 2022, 3:42pm UTC