# Is there any way to flush the conn log every so often

**URL:** <https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514>\
**Category:** Zeek\
**Created:** [June 23, 2009, 6:30pm UTC](https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514 "2009-06-23T18:30:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\
**Post date:** [June 23, 2009, 6:30pm UTC](https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514/1 "2009-06-23T18:30:25Z")

</div>

I have a connection that I am monitoring with a low amount of activity so the conn log rarely fills up enough to be flushed to disk. I would like to force a flush on it every so often. Is there a way to do this through a bro config file.

Bill Jones

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [June 23, 2009, 8:50pm UTC](https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514/2 "2009-06-23T20:50:18Z")

</div>

Yes, there are two options:

- file-flush.bro flushes all logs regurlarly (default: every 10s).

- the built-in function set\_buf() disables buffering for a  
particular log file; see the bro\_init() handler in remote.bro for an  
example. If there's not much traffic on the line, disabling the  
buffering for conn.log shouldn't be a problem.

Roin

---

<div class="post-metadata">

**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\
**Post date:** [June 25, 2009, 7:09pm UTC](https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514/3 "2009-06-25T19:09:24Z")

</div>

I used file-flush.bro to flush the logs. Thanks!

---

<div class="post-metadata">

**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\
**Post date:** [June 25, 2009, 7:18pm UTC](https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514/4 "2009-06-25T19:18:51Z")

</div>

I noticed that when I a restart bro using the cluster command that the current manager logs are not saved. What end up in the logs directive is data for only a few minutes as if bro reopened the logs before terminating.

Could some verify that bro work properly under bsd.  
I am running bro under linux and suspect that this is only a problem under linux and not bsd.

Bill Jones

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/is-there-any-way-to-flush-the-conn-log-every-so-often/1514/5 "2022-05-06T15:38:54Z")

</div>