Schedule an event

Zeek
1

I have a script based on the conn.log events. As connections are created it populates some information in a table. I need to trigger a search of that table to occur every 30 minutes. I believe I can use the “schedule” command but not entirely sure. So my question is, can I build a function within my script that does the table search and if so, how do I use the schedule command to trigger the function?

Thanks in advance,

Troy W

2

Hello Troy,

yes, you can indeed use schedule for that. Just create an event that does
the searching, schedule it once and then re-schedule it inside the event.

So something along the lines of:

event search()
  {
  # do the searching

  schedule 30min { search() };
  }

event bro_init()
  {
  schedule 30min { search() };
  }

Johanna