Disable analyzer

I am very new to zeek so please forgive this newbie qestion but how can I disable the analysys of a given protocol in zeek 5. In my case I would like to disable syslog protocol

Hello Lamorale,

you can use the Analyzer::disable_analyzer bif within zeek_init():

event zeek_init() {

As a convenience, there’s also a set of analyzers to disable at startup: Analyzer::disabled_analyzer. You can extend it via the following:

redef Analyzer::disabled_analyzers += {

Either snippet would be added to local.zeek, for example.

1 Like

Thanks a lot for your very fast response. It works fine