# Intelligence framework and bro logs

**URL:** <https://community.zeek.org/t/intelligence-framework-and-bro-logs/4521>\
**Category:** Zeek\
**Created:** [December 1, 2016, 5:34am UTC](https://community.zeek.org/t/intelligence-framework-and-bro-logs/4521 "2016-12-01T05:34:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nibbler\_nib](https://avatars.discourse-cdn.com/v4/letter/n/5daacb/32.png) [@Nibbler\_nib](https://community.zeek.org/u/Nibbler_nib)\
**Post date:** [December 1, 2016, 5:34am UTC](https://community.zeek.org/t/intelligence-framework-and-bro-logs/4521/1 "2016-12-01T05:34:03Z")

</div>

Hi Bro list,

I am starting to use Bro to check some IOCs on my network using the Bro Intelligence Framework, and I have few questions regarding my configuration :  
-I am updating the IOCs regularly and the only way I found to reload IOCs in bro is to restart the service with broctl, is there any better way? (like just reloading the configuration and not restarting everything)  
-When restarting bro with broctl, Bro is having a weird behaviour with logs, they are stored in directory with weird names (like 2039-01- 2039-02- 2039-10- 2046-49- 2050-58- 2051-03-…), have you already seen such case? Is it a due to a bad configuration? Or a bug? Is there a way to restart bro without rotating logs?

(all this with bro 2.5 compiled from sources)

Thanks  
N

---

<div class="post-metadata">

**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\
**Post date:** [December 1, 2016, 10:24am UTC](https://community.zeek.org/t/intelligence-framework-and-bro-logs/4521/2 "2016-12-01T10:24:01Z")

</div>

Hi N,

> -I am updating the IOCs regularly and the only way I found to reload IOCs  
> in bro is to restart the service with broctl, is there any better way?  
> (like just reloading the configuration and not restarting everything)

using Bro 2.5 you can use the new expiration feature of the intel  
framework. There might be a blog post explaining the details. I will  
check that.

Best regards  
Jan

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/intelligence-framework-and-bro-logs/4521/3 "2022-05-06T15:44:21Z")

</div>