Is there any way to flush the conn log every so often

Zeek
2

Yes, there are two options:

- file-flush.bro flushes all logs regurlarly (default: every 10s).

- the built-in function set_buf() disables buffering for a
particular log file; see the bro_init() handler in remote.bro for an
example. If there's not much traffic on the line, disabling the
buffering for conn.log shouldn't be a problem.

Roin