Disable analyzer

Zeek
1

I am very new to zeek so please forgive this newbie qestion but how can I disable the analysys of a given protocol in zeek 5. In my case I would like to disable syslog protocol

2

Hello Lamorale,

you can use the Analyzer::disable_analyzer bif within zeek_init():

event zeek_init() {
    Analyzer::disable_analyzer(Analyzer::ANALYZER_SYSLOG);
}

As a convenience, there’s also a set of analyzers to disable at startup: Analyzer::disabled_analyzer. You can extend it via the following:

redef Analyzer::disabled_analyzers += {
    Analyzer::ANALYZER_SYSLOG,
};

Either snippet would be added to local.zeek, for example.

1 Like
3

Thanks a lot for your very fast response. It works fine