# logging to multiple locations in a cluster

**URL:** <https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414>\
**Category:** Zeek\
**Created:** [October 14, 2016, 2:52pm UTC](https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414 "2016-10-14T14:52:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [October 14, 2016, 2:52pm UTC](https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414/1 "2016-10-14T14:52:02Z")

</div>

Is it possible to log to more than one location? I want my broctl to push a remote logger, AND log locally, for redundancy in case the remote logger dies.

So, each capture node in the cluster should be instructed to log to that capture node, and copy across the wire to the logger node(s). If this is not possible, is there a way to perhaps sniff the outbound link and log that?

Erik

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [October 14, 2016, 3:02pm UTC](https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414/2 "2016-10-14T15:02:54Z")

</div>

Yes, it is.

I think you only have to redef Log::enable\_local\_logging to true on the workers (it is usually set to false when enabling cluster mode).

Johanna

---

<div class="post-metadata">

**Author:** ![JonZeolla](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@JonZeolla](https://community.zeek.org/u/JonZeolla)\
**Post date:** [October 14, 2016, 3:11pm UTC](https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414/3 "2016-10-14T15:11:00Z")

</div>

I’m not positive about your exact scenario, but I am currently logging to multiple locations. For instance - to flat files, and to a kafka topic - but there is much more that I could be doing. See the [logging framework](https://www.bro.org/sphinx/scripts/base/frameworks/logging/main.bro.html).

Jon

---

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [October 14, 2016, 3:19pm UTC](https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414/4 "2016-10-14T15:19:53Z")

</div>

Yep, ok, can do. Thanks Johanna and Zoella!

So redef in local-worker.bro?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/logging-to-multiple-locations-in-a-cluster/4414/5 "2022-05-06T15:44:09Z")

</div>