# Properly disabling certain rules

**URL:** <https://community.zeek.org/t/properly-disabling-certain-rules/3153>\
**Category:** Zeek\
**Created:** [June 18, 2014, 2:09pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153 "2014-06-18T14:09:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [June 18, 2014, 2:09pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153/1 "2014-06-18T14:09:17Z")

</div>

Team,

So...after upgrading to Bro 2.3, syslog and ssl have returned, which I do not want to see. I commented them out in init-default.bro, which is not the right way to go I know. How can I disable these in my local.bro? Thank you.

James

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [June 18, 2014, 2:53pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153/2 "2014-06-18T14:53:18Z")

</div>

Heh...got it already:

event bro\_init()  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Log::disable\_stream(Syslog::LOG);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

Thanks all.

James

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu1](https://avatars.discourse-cdn.com/v4/letter/v/f9ae1b/32.png) [@Vlad\_Grigorescu1](https://community.zeek.org/u/Vlad_Grigorescu1)\
**Post date:** [June 18, 2014, 2:56pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153/3 "2014-06-18T14:56:30Z")

</div>

Hi James,

Just as a matter of terminology, these aren't rules, but analyzers. 🙂

Try something like this to your local.bro:

> event bro\_init() {  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Analyzer::disable\_analyzer(Analyzer::ANALYZER\_SSL);  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Analyzer::disable\_analyzer(Analyzer::ANALYZER\_SYSLOG);  
> }

--Vlad

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [June 18, 2014, 3:01pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153/4 "2014-06-18T15:01:19Z")

</div>

Thanks for the clarification Vlad...helps if I at least SOUND like I know what I'm talking about 😃

James

---

<div class="post-metadata">

**Author:** ![Ward\_Sladek](https://avatars.discourse-cdn.com/v4/letter/w/ecae2f/32.png) [@Ward\_Sladek](https://community.zeek.org/u/Ward_Sladek)\
**Post date:** [June 18, 2014, 3:23pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153/5 "2014-06-18T15:23:43Z")

</div>

I eliminate syslog via the following in my local.bro:

# Disable Syslog

event bro\_init()  
{  
Log::disable\_stream(Syslog::LOG);  
}

Not sure if that is the recommended way, but it works.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/properly-disabling-certain-rules/3153/6 "2022-05-06T15:41:51Z")

</div>