# log-append.bro

**URL:** <https://community.zeek.org/t/log-append-bro/2825>\
**Category:** Zeek\
**Created:** [September 23, 2013, 1:51pm UTC](https://community.zeek.org/t/log-append-bro/2825 "2013-09-23T13:51:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Po-Ching\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@Po-Ching\_Lin](https://community.zeek.org/u/Po-Ching_Lin)\
**Post date:** [September 23, 2013, 1:51pm UTC](https://community.zeek.org/t/log-append-bro/2825/1 "2013-09-23T13:51:10Z")

</div>

Hi,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;I would like to append the logs in the current run to existing logs. There was  
log-append.bro which can change the default setting in earlier Bro. How could  
it be done in Bro 2.1? open\_log\_file is defined in init-bare.bro, which seems not  
loaded in init-default.bro, so changing open to open\_for\_append in its definition  
does not work. I run bro directly from the command line as "bro -r xxx.pcap".  
Any suggestion is appreciated.

Po-Ching

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [September 24, 2013, 9:01pm UTC](https://community.zeek.org/t/log-append-bro/2825/2 "2013-09-24T21:01:18Z")

</div>

Bro 2.x doesn't support that anymore as the logs no longer use the  
open\*() functions but go through the internal logging system. You  
could work around it by definining a post-processor which takes the  
log file and copies/appends it to somewhere else.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/log-append-bro/2825/3 "2022-05-06T15:41:14Z")

</div>

Closed on May 6, 2022, 3:41pm UTC


