# send logs to custom server by socket

**URL:** <https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580>\
**Category:** Zeek\
**Created:** [April 30, 2015, 5:17am UTC](https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580 "2015-04-30T05:17:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mo\_Jia](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mo\_Jia](https://community.zeek.org/u/Mo_Jia)\
**Post date:** [April 30, 2015, 5:17am UTC](https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580/1 "2015-04-30T05:17:12Z")

</div>

Hello:

If I don't want log to disk, and want send json logs to a remote  
server. When some code like this Log::write(HTTP::LOG, c$http); it was  
send http log to my server. Dose this mean I need change  
src/logging/writters/ascii ? Or I should add a new writer something  
like socket? I don't want change the bro scripts already have, so  
Log:write(HTTP::LOG, c$http) should don't change. Or I think is  
add a config like

LOG\_SERVER\_IP = 192.168.100  
LOG\_SERVER\_PORT = 8087

and all the http , notice and so on all send to the server.  
Any suggest? Or does somebody already done before?

---

<div class="post-metadata">

**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\
**Post date:** [May 1, 2015, 1:38am UTC](https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580/2 "2015-05-01T01:38:15Z")

</div>

I believe you likely want functionality that technically exists in Master.

Check out remote logging with Broker... [https://www.bro.org/sphinx-git/frameworks/broker.html#remote-logging](https://www.bro.org/sphinx-git/frameworks/broker.html#remote-logging)

I haven't played with that yet, so I can't be certain it does precisely what you want...

Alternatively, you could just delete the logs after they rotate and send the logs via syslog with rsyslog, or your syslog daemon of choice.

Let me know if that helps!

---

<div class="post-metadata">

**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\
**Post date:** [May 3, 2015, 11:53am UTC](https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580/3 "2015-05-03T11:53:19Z")

</div>

Is this a bro only broker or does it communicate amqp ?

---

<div class="post-metadata">

**Author:** ![Mo\_Jia](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mo\_Jia](https://community.zeek.org/u/Mo_Jia)\
**Post date:** [May 3, 2015, 1:43pm UTC](https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580/4 "2015-05-03T13:43:35Z")

</div>

The bro log should send to a stream handing process, may be kafka or  
storm for preprocessing the logs .(Which I need to redefine the logs  
field , and add more precise fields in one proto like http). So  
directly log to elasticsearch may be not a good method.

Also, does bro supports to understand code by switch some macro , So I  
can see (for example how a packet was handing, from begging to end),  
I don't want make debug-version and step by step in gdb to see which  
func was called. Something like a debug log of call orders?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/send-logs-to-custom-server-by-socket/3580/5 "2022-05-06T15:42:38Z")

</div>