# How can I do report cyclically

**URL:** <https://community.zeek.org/t/how-can-i-do-report-cyclically/199>\
**Category:** Zeek\
**Created:** [November 9, 2001, 8:49am UTC](https://community.zeek.org/t/how-can-i-do-report-cyclically/199 "2001-11-09T08:49:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [November 9, 2001, 8:49am UTC](https://community.zeek.org/t/how-can-i-do-report-cyclically/199/1 "2001-11-09T08:49:08Z")

</div>

> I would like to have reports cyclically of my network usage beside the  
> intrusion detection, so I have a short script like the attached file.  
> Unfortunatelly, bro seems do nothing with reporting. It isn't documented, so  
> can you draw me a way of doing that?

Your script has the right idea. The main thing missing is that "schedule"  
only schedules an event to occur once, so you need to reschedule it if  
you want it to repeat. So change:

&nbsp;&nbsp;event report\_status()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;local res = resource\_usage();

&nbsp;&nbsp;&nbsp;&nbsp;log fmt("Up time: %s; Max used memory ..."  
&nbsp;&nbsp;}

to:

&nbsp;&nbsp;event report\_status()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;local res = resource\_usage();

&nbsp;&nbsp;&nbsp;&nbsp;log fmt("Up time: %s; Max used memory ..."

&nbsp;&nbsp;&nbsp;&nbsp;schedule +1min { report\_status() };  
&nbsp;&nbsp;}

The other problem you may be running into is that Bro uses the  
timestamps of the incoming packet stream as its clock. So if the  
packet filter isn't accepting any packets, then "time" doesn't  
in fact advance, and timers don't expire. (Clearly, this is a  
deficiency.) So that may be why you never got any output at all.

Also, a note. You extended the existing bro\_init() to schedule  
the event:

&nbsp;&nbsp;event bro\_init()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;if ( restrict\_filter == "" && capture\_filter == "" )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print "tcp or not tcp";  
&nbsp;&nbsp;&nbsp;&nbsp;else if ( restrict\_filter == "" )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print capture\_filter;  
&nbsp;&nbsp;&nbsp;&nbsp;else if ( capture\_filter == "" )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print restrict\_filter;  
&nbsp;&nbsp;&nbsp;&nbsp;else  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print fmt("(%s) and (%s)", capture\_filter, restrict\_filter);

&nbsp;&nbsp;&nbsp;&nbsp;schedule +1 min { report\_status() };  
&nbsp;&nbsp;}

but it works just as well to instead define a \*new\* bro\_init event handler:

&nbsp;&nbsp;event bro\_init()  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;schedule +1 min { report\_status() };  
&nbsp;&nbsp;&nbsp;&nbsp;}

This handler will be invoked \*in addition\* to the already existing one.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/how-can-i-do-report-cyclically/199/2 "2022-05-06T15:36:24Z")

</div>