# Question about creating custom conn logs. **URL:** \ **Category:** Zeek\ **Created:** [April 24, 2007, 2:41am UTC](https://community.zeek.org/t/question-about-creating-custom-conn-logs/1168 "2007-04-24T02:41:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Alen\_Capalik](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@Alen\_Capalik](https://community.zeek.org/u/Alen_Capalik)\ **Post date:** [April 24, 2007, 2:41am UTC](https://community.zeek.org/t/question-about-creating-custom-conn-logs/1168/1 "2007-04-24T02:41:30Z")
Hi all, I was wondering if someone can point me in the right direction regarding creating custom connection logs in Bro. I'm sorry in advance if this is a question already asked before, but I could not find the answer or something remotely close to an answer. I want to add some fields to current conn.\.log files (namely for instance tcp sequence numbers) for all tcp connections or I want to create new connection log files with new fields. I have written new function (similar to record\_connection()) in \.bro file as well as new event calling that function. The log files get created, but nothing is ever logged into them. I guess my question would be, how do I create an event calling this function that will just record all tcp network traffic into customized log files? I really don't want to do anything special to it, I just want to log the traffic with the format I defined in the function. I have been using pkt\_hdr, ip\_hdr, tcp\_hdr, udp\_hdr data types from bro.init to add additional fields in fmt(). If you can just give me a quick format of the event that would do that, it would help tremendously, I can do the rest myself. I hope this is enough information, if not please let me know. Thank you in advance for any help. Regards, Alen ---
**Author:** ![Mark\_Dedlow](https://avatars.discourse-cdn.com/v4/letter/m/74df32/32.png) [@Mark\_Dedlow](https://community.zeek.org/u/Mark_Dedlow)\ **Post date:** [April 24, 2007, 2:45pm UTC](https://community.zeek.org/t/question-about-creating-custom-conn-logs/1168/2 "2007-04-24T14:45:41Z")
Alen, I'm not a bro expert, just a novice user, but here's what I think. First, if you have questions about your code, post the code. It's hard to tell what exactly you're doing from the description. You don't need to create an event to do what you want. Rather, you create an \*event handler\*. Bro generates the events, and runs your handler at the appropriate time. For example, here's an event handler that gets run when a connection is finished, that is, this is a handler for the built-in 'connection\_finished' event. The handler receives a single parameter, which is a connection record. event connection\_finished(c: connection) {      print fmt("conn %s:%d -\> %s:%d",                 c$id$orig\_h, c$id$orig\_p, c$id$resp\_h, c$id$resp\_p) ; } Print this to a file, and that is a minimal example of a custom connection logging policy. (note that in a real app, connection\_finished is not the event you want, since it will not run for a connection that never finishes explicitly (FIN). The event connection\_state\_remove fires shortly after connection\_finished, or when an unfinished connection is timed out) As far as logging sequence numbers, keep in mind that connections are at a different level of abstraction than sequence numbers, which exist at the packet level. The bro 'connection' record has no record of any individual packets. To get sequence numbers, you need to write handlers for packet-level events. Here's an example of a policy that would record the sequence number of the SYN packet for a connection. Note that the built-in event 'new\_packet' is passed parameters of connection record and the packet, so you can correlate packets with connections. global conns\_syn\_seq: table[conn\_id] of count; event new\_packet(c: connection, p: pkt\_hdr) {      # keep the SYN sequence number      if ( p$tcp$flags == 2 )          conns\_syn\_seq[c$id] = p$tcp$seq; } event connection\_finished(c: connection) {      print fmt("conn %s:%d -\> %s:%d (SYNseq#=%d)",                c$id$orig\_h, c$id$orig\_p, c$id$resp\_h, c$id$resp\_p,                conns\_syn\_seq[c$id] ); } Mark Alen Capalik wrote: ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/question-about-creating-custom-conn-logs/1168/3 "2022-05-06T15:38:15Z")