# example from manual

**URL:** https://community.zeek.org/t/example-from-manual/2715
**Category:** Zeek
**Created:** [June 27, 2013, 4:41pm UTC](https://community.zeek.org/t/example-from-manual/2715 "2013-06-27T16:41:07Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)
#### Post date: [June 27, 2013, 4:41pm UTC](https://community.zeek.org/t/example-from-manual/2715/1 "2013-06-27T16:41:07Z")

</div>

[http://bro.org/sphinx/notice.html](http://bro.org/sphinx/notice.html)

Where does the example syntax get placed?

---

<div class="post-metadata">

### Author: ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [June 27, 2013, 5:00pm UTC](https://community.zeek.org/t/example-from-manual/2715/2 "2013-06-27T17:00:30Z")

</div>

You could put it in local.bro or a better idea might be to place a new file of your own in \<prefix\>/share/bro/site/ and and add an "@load myfile" line to local.bro.

Like this…

in \<prefix\>/share/bro/site/myfile.bro:  
&nbsp;&nbsp;print "hello world";

in \<prefix\>/share/bro/site/local.bro:  
&nbsp;&nbsp;@load myfile

Are you running Bro with broctl or just running it directly? If you run with broctl, that local.bro script will automatically get loaded (and subsequently load your script).

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

### Author: ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)
#### Post date: [June 27, 2013, 5:03pm UTC](https://community.zeek.org/t/example-from-manual/2715/3 "2013-06-27T17:03:39Z")

</div>

Yes. I am running it via security onion.

---

<div class="post-metadata">

### Author: ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)
#### Post date: [June 27, 2013, 5:11pm UTC](https://community.zeek.org/t/example-from-manual/2715/4 "2013-06-27T17:11:23Z")

</div>

In the example, if I wanted it to log this info instead of ACTION\_EMAIL,  
what would I change it too? ACTION\_ALARM or ACTION\_LOG?

---

<div class="post-metadata">

### Author: ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [June 27, 2013, 5:13pm UTC](https://community.zeek.org/t/example-from-manual/2715/5 "2013-06-27T17:13:39Z")

</div>

All notices are logged by default in notice.log.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/example-from-manual/2715/6 "2022-05-06T15:41:03Z")

</div>