# ignoring all weird? **URL:** \ **Category:** Zeek\ **Created:** [March 30, 2010, 4:55pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601 "2010-03-30T16:55:41Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Tim\_Rupp](https://avatars.discourse-cdn.com/v4/letter/t/9de053/32.png) [@Tim\_Rupp](https://community.zeek.org/u/Tim_Rupp)\ **Post date:** [March 30, 2010, 4:55pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/1 "2010-03-30T16:55:41Z")
Is there a convenient way that I can suppress all weird messages that would otherwise bubble up to the weird log? I've done this redef notice\_action\_filters += {         [[Weird::WeirdActivity,           Weird::ContentGap,           Weird::RetransmissionInconsistency,           Weird::AckAboveHole]] = ignore\_notice }; But I still get some weird messages that I need to suppress like this redef Weird::weird\_action: table[string] of Weird::WeirdAction += {         [["above\_hole\_data\_without\_any\_acks",           "bad\_TCP\_checksum",           "unmatched\_HTTP\_reply",           "connection\_originator\_SYN\_ack",           "window\_recision",           "unescaped\_special\_URI\_char",           "bad\_UDP\_checksum",           "data\_before\_established",           "inflate\_failed",           "line\_terminated\_with\_single\_CR"         ]] = Weird::WEIRD\_IGNORE }; Ideas? Thanks, -Tim ---
**Author:** ![Justin\_Azoff](https://avatars.discourse-cdn.com/v4/letter/j/eb9ed0/32.png) [@Justin\_Azoff](https://community.zeek.org/u/Justin_Azoff)\ **Post date:** [March 30, 2010, 6:02pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/2 "2010-03-30T18:02:00Z")
try something like this: redef suppress\_notice\_actions += {     Weird::ContentGap,     Weird::AckAboveHole,     Weird::WeirdActivity, }; ---
**Author:** ![Tim\_Rupp](https://avatars.discourse-cdn.com/v4/letter/t/9de053/32.png) [@Tim\_Rupp](https://community.zeek.org/u/Tim_Rupp)\ **Post date:** [March 31, 2010, 1:53pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/3 "2010-03-31T13:53:03Z")
I was hoping it'd be that easy, but now the weird messages (content gap, ack above a hole, etc) are going to stdout as well as the weird log. Ideas? Thanks, -Tim ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 31, 2010, 4:47pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/4 "2010-03-31T16:47:04Z")
I don't think we currently have a way to generally suppress all weird messages, just individually per your earlier mail. It is however posssible to remove them from notice.log by mapping corresponding notice types to NOTICE\_IGNORE. Justin's solution is almost doing that but it just suppresses the notice\_action\_event, not the actual reporting (that event is used mostly internally). Use either notice\_policy or notice\_action\_filters instead. Robin ---
**Author:** ![Tim\_Rupp](https://avatars.discourse-cdn.com/v4/letter/t/9de053/32.png) [@Tim\_Rupp](https://community.zeek.org/u/Tim_Rupp)\ **Post date:** [April 1, 2010, 6:40pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/5 "2010-04-01T18:40:59Z")
One of my co-workers pointed out that, while it may be a poor workaround, I can kinda get the functionality I was looking for by doing the redef notice\_action\_filters += {         [[Weird::WeirdActivity,           Weird::ContentGap,           Weird::RetransmissionInconsistency,           Weird::AckAboveHole]] = ignore\_notice }; and then redef'ing the weird file to /dev/null redef Weird::weird\_file = open\_log\_file("/dev/null"); Weird messages go away, but I wonder if this would cause chaos with many bros trying to open /dev/null concurrently to write the weird log. Maybe I'll just rotate my weird log more frequently. Thanks for the pointers! -Tim ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [April 1, 2010, 7:05pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/6 "2010-04-01T19:05:34Z")
Interesting idea. 🙂 Should work, except that I don't dare to predict what the log rotation code does with that ... Robin ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [April 1, 2010, 7:31pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/7 "2010-04-01T19:31:48Z")
> redef Weird::weird\_file = open\_log\_file("/dev/null"); FYI, I believe Seth Hall sometimes gets the same effect by closing the file. I'm not sure how that will interact with log rotation either.     Vern ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [April 1, 2010, 8:04pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/8 "2010-04-01T20:04:56Z")
Yep. It doesn't seem to have any noticeable effect. close-ing the file handle also seems to unhook the print\_hook so that remote printing is disabled as well. Setting the file to /dev/null would leave remote printing enabled which could cause extra communication between hosts in multihost setups (cluster).    .Seth ---
**Author:** ![Matthias\_Vallentin2](https://avatars.discourse-cdn.com/v4/letter/m/65b543/32.png) [@Matthias\_Vallentin2](https://community.zeek.org/u/Matthias_Vallentin2)\ **Post date:** [April 11, 2010, 3:45pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/9 "2010-04-11T15:45:22Z")
I just tried this from the userspace:     error: cannot open /dev/null.log: Permission denied The function open\_log\_file apparently adds a \*.log suffix before opening the file. Assuming that you tried this as root, you probably won't have gotten an error message. Could you double-check that no /dev/null.log exist?    Matthias ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [April 11, 2010, 3:52pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/10 "2010-04-11T15:52:17Z")
> The function open\_log\_file apparently adds a \*.log suffix before opening Yep, or more generally, $BRO\_LOG\_SUFFIX. You can use open() directly to avoid this.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/ignoring-all-weird/1601/11 "2022-05-06T15:39:04Z")