log-append.bro

Zeek
1

Hi,

       I would like to append the logs in the current run to existing logs. There was
log-append.bro which can change the default setting in earlier Bro. How could
it be done in Bro 2.1? open_log_file is defined in init-bare.bro, which seems not
loaded in init-default.bro, so changing open to open_for_append in its definition
does not work. I run bro directly from the command line as "bro -r xxx.pcap".
Any suggestion is appreciated.

Po-Ching

2

Bro 2.x doesn't support that anymore as the logs no longer use the
open*() functions but go through the internal logging system. You
could work around it by definining a post-processor which takes the
log file and copies/appends it to somewhere else.

Robin