Disable Log Stream but not the analyzers

Zeek
1

I have disabled the Log Stream for HTTP :

event bro_init()
{
Log::disable_stream(HTTP::LOG);
}

But i want scripts using HTTP protocol to work e.g https://raw.githubusercontent.com/sethhall/bro-scripts/master/top-websites.bro

Is there any other way to do it ?

2

Hi,

Using

Log::remove_default_filter(HTTP::LOG);

instead of disable_stream should do what you want.

3

Hi i did change it but no logs regarding http are produced like https://raw.githubusercontent.com/sethhall/bro-scripts/master/top-websites.bro or https://github.com/BrashEndeavours/bro-scripts/blob/master/http_entropy.bro .

image.png

image.png
image.png1447×49 4.35 KB

Στις Τετ, 21 Νοε 2018 στις 11:03 μ.μ., ο/η Azoff, Justin S <jazoff@illinois.edu> έγραψε:

4

Indeed, scripts you’re showing depend on the log streams you just disabled.

5

So there is no way to disable specific logs but still use the analyzers in the script ? The scripts are reading the actual logs and needed from them to work ?

Στις Πέμ, 22 Νοε 2018 στις 10:58 π.μ., ο/η Michał Purzyński <michalpurzynski1@gmail.com> έγραψε:

6

Read my response again…

Using Log::remove_default_filter does what you want. You used remove_stream which is something different.

7

Yes you are correct it works ! Thanks a lot