# logging in bro

**URL:** <https://community.zeek.org/t/logging-in-bro/78>\
**Category:** Zeek\
**Created:** [March 20, 2000, 8:38am UTC](https://community.zeek.org/t/logging-in-bro/78 "2000-03-20T08:38:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [March 20, 2000, 8:38am UTC](https://community.zeek.org/t/logging-in-bro/78/1 "2000-03-20T08:38:31Z")

</div>

> I have been working with the log files in bro (weird.log, bro.log,  
> ftp.log, etc) and have noticed that they are written out in chunks of 4096  
> bytes.
> 
> I know that this is possibly done for performance reasons, but has anyone  
> tried/done writing out to the log files in "real-time" (i.e., as soon  
> there is data to be written out (i.e., without buffering))?

I've been wanting to add a flush directive, and/or a signal handler  
(for HUP, say) that would flush the files, but haven't gotten around to  
it yet.

> I have looked through the code looking for how and where this "buffering"  
> is specified and how the "chunk size" is specified to be 4096, but have  
> not had much success.

It's just the default size used by stdio. On my development system (FreeBSD),  
it's 8192 bytes, by the way.

Note, though, that bro.log should be written unbuffered. If it's buffered  
on your system, something strange is going on - there's an explict fflush()  
in Logger.cc to make sure it goes out each time it's written.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/logging-in-bro/78/2 "2022-05-06T15:36:09Z")

</div>