# How to control when bro logs events

**URL:** <https://community.zeek.org/t/how-to-control-when-bro-logs-events/26>\
**Category:** Zeek\
**Created:** [October 14, 1998, 10:23pm UTC](https://community.zeek.org/t/how-to-control-when-bro-logs-events/26 "1998-10-14T22:23:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sthaug](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@sthaug](https://community.zeek.org/u/sthaug)\
**Post date:** [October 14, 1998, 10:23pm UTC](https://community.zeek.org/t/how-to-control-when-bro-logs-events/26/1 "1998-10-14T22:23:28Z")

</div>

I've just started to investigate bro here. I'd like to use it for real  
time network monitoring, and an obvious (to me) question is: How quickly  
is an event (say, a TCP session finishing the normal way) logged? How can  
I control this?

I assume I might have to turn off stdio buffering to be able to see such  
events right away. Are there other knobs to adjust?

Steinar Haug, Nethelp consulting, sthaug@nethelp.no

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/how-to-control-when-bro-logs-events/26/2 "2022-05-06T15:36:03Z")

</div>