Printing a header when a file is opened/rotated

Prior to using broctl I was using a setup like this:

const phish_log = open_log_file("phish") &raw_output;

event bro_init()
{
    print phish_log, cat_sep("\t", "\\N", "start", "orig_h", "mailfrom", "replyto", "subject");
}

Now that I'm using broctl, it rotates the logs once a day to their new locations. My problem is that
when the file is rotated nothing re-adds the header.

I'm not sure what the best way to fix this is. I know I could disable the
rotate interval and go back to restarting bro everyday at midnight. Could
something like this work?

event rotate_interval(f: file) &priority=10
{
    if (f$name == "phish.log"){
        print f, cat_sep("\t", "\\N", "start", "orig_h", "mailfrom", "replyto", "subject");
    }
}

I'm thinking that if there was a file_opened event then that could be used
to handle both cases.

event rotate_interval(f: file) &priority=10
{
    if (f$name == "phish.log"){
        print f, cat_sep("\t", "\\N", "start", "orig_h", "mailfrom", "replyto", "subject");
    }
}

Nice thought! It's kind of a hack but I think that could indeed
work, except that instead of f$name you need to use the builtin
function get_file_name(). I'm wondering if there's a race condition
lurking somewhere here but I'm thinking it should be ok ...

Another approach would be writing a shell wrapper around broctl's
log archival script. BroControl sets the following:

    redef RotateLogs::default_postprocessor = "archive-log";
    
You could redef that to your own script, which first prepends the
header to the rotated file (needs a bit of copying the data around
unfortunately) and then continues by calling archive-log.

However, I think the right way of solving your problem is indeed
this:

I'm thinking that if there was a file_opened event then that could be used
to handle both cases.

I like that. Please file a feature request with our tracker.

Robin