# log rotation

**URL:** <https://community.zeek.org/t/log-rotation/4744>\
**Category:** Zeek\
**Created:** [March 26, 2017, 6:18pm UTC](https://community.zeek.org/t/log-rotation/4744 "2017-03-26T18:18:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ul\_Asad\_Hafiz](https://avatars.discourse-cdn.com/v4/letter/u/dec6dc/32.png) [@Ul\_Asad\_Hafiz](https://community.zeek.org/u/Ul_Asad_Hafiz)\
**Post date:** [March 26, 2017, 6:18pm UTC](https://community.zeek.org/t/log-rotation/4744/1 "2017-03-26T18:18:03Z")

</div>

Hi,

I am analysing a large number of “pcap” files using,

bro –r \*.pcap my\_bro.script

The problem is that for each new pcap file, bro over-writes the previous \*.log files if I don’t change my working directory. Is there a way of controlling the rotation of log files? I know that “broctl” has this time base rotation, but is there any sort of rotation control when bro is run from command line? I can change the working directory, but I want to have all my results in a single a log file (files) so that it is easy to query them.

Regards

Asad

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [April 5, 2017, 4:37pm UTC](https://community.zeek.org/t/log-rotation/4744/2 "2017-04-05T16:37:29Z")

</div>

Hi Asad,

Bro currently does not support appending data to the same log file over  
several runs.

The typical way to solve this is to have a script which generates a new  
directory for each run, automatically changes the working dorectory to it,  
and runs Bro from there. Afterwards you can concatenate the output files.

I hope this helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/log-rotation/4744/3 "2022-05-06T15:44:46Z")

</div>


