# logging locally and to remote logger

**URL:** <https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485>\
**Category:** Zeek\
**Created:** [November 14, 2016, 2:35pm UTC](https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485 "2016-11-14T14:35:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [November 14, 2016, 2:35pm UTC](https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485/1 "2016-11-14T14:35:18Z")

</div>

So, if I use:

redef Log::enable\_local\_logging

in a bro worker cluster, what I find is that all the logs go to /data/bro/spool/worker-1-X instead of all in /data/bro/logs/current on the local machine… Is there a way to fix this?

Also, I would want to rotate logs out on the workers that are doing additional local logging to have a much more constrained timeframe for logging, specifically 1 week for local nodes, and 3 months for the logger host.

Is the best way to do this just with a cron rm -rf /data/bro/logs/$date ? It seems this would run into a conflict with broctlconfig…

Thanks!

---

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [November 15, 2016, 11:31am UTC](https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485/2 "2016-11-15T11:31:25Z")

</div>

Hi,

If you wish to log locally and you care about the worker-id who produce this logged event :

- to know what is the worker-id you can add a field “worker” to your logs and populate it from bro script using : get\_event\_peer()$descr

- to change the rotation for each log (here, rotate every 200 minutes) you need to use

- LOG::remove\_default\_filter(SSH::LOG);

- and then add LOG::add\_filter(SSH::LOG, [$name=“ssh”,$path=“ssh”, **$interv=200min** , $include=(“field1”,“field2”)]

- btw, you can set $path to be a mounted dir- to save the log to another machine simultaneously :

- use bro, add a new writer ([https://www.bro.org/sphinx/scripts/base/frameworks/logging/main.bro.html#id-Log::default\_writer](https://www.bro.org/sphinx/scripts/base/frameworks/logging/main.bro.html#id-Log::default_writer)) and then add\_filter to ssh and ask it to use the new writer

- use syslog, just monitor this main local log and transmit it to another machine  
Hope it helps

---

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [November 15, 2016, 12:15pm UTC](https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485/3 "2016-11-15T12:15:55Z")

</div>

Ah, I think there is some confusion. Out of the box if you log locally as well as using a remote logger (2.5), the logs locally get shoved into worker buckets. I was hoping to see how it would be possible to get standard cluster behavior, where all workers log locally to one bucket instead of each worker having its own bucket.

Anyone know why this logs to separate buckets in the first place?

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 28, 2016, 11:12pm UTC](https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485/4 "2016-11-28T23:12:26Z")

</div>

Hi Erik,

the workers log to one directory each, to not conflict with each other. If  
you have several active workers on one machine, they cannot local-log to  
the same directory/file because they would conflict with each other and  
you would get files where different workers might write into lines of  
other workers.

As soon as you want merged logs from more than one Bro instance, you need  
remote-logging (even if the manager/logger for the workers is on the same  
machine).

I hope this helps 🙂  
Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/logging-locally-and-to-remote-logger/4485/5 "2022-05-06T15:44:17Z")

</div>