# Overwriting logs

**URL:** <https://community.zeek.org/t/overwriting-logs/5368>\
**Category:** Zeek\
**Created:** [June 26, 2018, 8:05pm UTC](https://community.zeek.org/t/overwriting-logs/5368 "2018-06-26T20:05:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![john\_Y1](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@john\_Y1](https://community.zeek.org/u/john_Y1)\
**Post date:** [June 26, 2018, 8:05pm UTC](https://community.zeek.org/t/overwriting-logs/5368/1 "2018-06-26T20:05:40Z")

</div>

Hello all!  
Need advice about a problem i have:

I am initiating many bro command on dynamically incoming pcaps, such as:  
“bro -r some\_file\_name”.

On every run, logs are created in the same directory, but the next run rewrite those logs. How can bro create logs with uniqe log name foreach run?

Also tried to add timestamp to the log name but did not find how to get current time.

Love for your help,  
John

---

<div class="post-metadata">

**Author:** ![Bowen\_Li](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@Bowen\_Li](https://community.zeek.org/u/Bowen_Li)\
**Post date:** [June 27, 2018, 2:52am UTC](https://community.zeek.org/t/overwriting-logs/5368/2 "2018-06-27T02:52:24Z")

</div>

Hi John，  
I think bro just truncate the log file, maybe you can do something in Ascii::DoInit function in file /logging/writers/ascii/Ascii.cc to get what you need.  
Hope this will help you.

Bowen Li

john Y \<[yjohn9691@gmail.com](mailto:yjohn9691@gmail.com)\> 于2018年6月27日周三 上午4:21写道：

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [June 29, 2018, 4:14pm UTC](https://community.zeek.org/t/overwriting-logs/5368/3 "2018-06-29T16:14:04Z")

</div>

Hi,

traditionally we recommended that you just run Bro in a different  
directory each time. Which is typically easily scriptable - just create a  
small bash script that changes the directory before running Bro for each  
pcap.

There actually is a reason that we don't (currently) support appending to  
Logs. The reason is that we cannot guarantee that the columns do not  
change inbetween runs - in theory you can change your scripts between Bro  
runs to add/remove/change a column.

This will mess up nearly anything that parses Bro logs - even though a new  
#fields header would be added, most software only looks at the first one  
in the file.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/overwriting-logs/5368/4 "2022-05-06T15:45:54Z")

</div>

Closed on May 6, 2022, 3:45pm UTC