Good afternoon everyone,
My name is Aaron Haycraft. I am attempting to work with Bro for a project and I am having some
issues. I am running Bro from the command line on a Fedora machine, and I want to run a lot of PCAP files through it. For example, the lines of code I run are “bro -r test.pcap” and “bro -r test2.pcap”, and so on. However, when I do so, the logs seem to overwrite after awhile and I lose a lot of data. I know that when Bro runs, it stores the logs in the local directory, but after the log gets full, it goes somewhere that I don’t know. Is there anyway to get around this, such that everything goes into one big log file?
Thank you for your time,