# Signature payload matching

**URL:** https://community.zeek.org/t/signature-payload-matching/1917
**Category:** Zeek
**Created:** [July 7, 2011, 7:23am UTC](https://community.zeek.org/t/signature-payload-matching/1917 "2011-07-07T07:23:34Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Rodrigue\_ALAHASSA](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@Rodrigue\_ALAHASSA](https://community.zeek.org/u/Rodrigue_ALAHASSA)
#### Post date: [July 7, 2011, 7:23am UTC](https://community.zeek.org/t/signature-payload-matching/1917/1 "2011-07-07T07:23:34Z")

</div>

Hi,

Once a signature has been written, compiled and matched against a traffic. I noticed that sometimes there are entries in signatures.log and notice.log, sometimes there is only entries in notice.log.

I didn’t change default settings for signatures.bro yet (no local site configuration). I wonder when (cases) bro is told to write to signatures.log.

Thanks.

Rodrigue

---

<div class="post-metadata">

### Author: ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)
#### Post date: [July 7, 2011, 3:20pm UTC](https://community.zeek.org/t/signature-payload-matching/1917/2 "2011-07-07T15:20:03Z")

</div>

Can you send an example including the entries in the logs and the  
signatures?

Robin

---

<div class="post-metadata">

### Author: ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)
#### Post date: [July 7, 2011, 10:09pm UTC](https://community.zeek.org/t/signature-payload-matching/1917/3 "2011-07-07T22:09:56Z")

</div>

The matches reported in auto/signatures.log and auto/notices.log are  
the same as far as I can see. And I don't see any reported in test/\*.  
So not sure what the problem is?

Robin

---

<div class="post-metadata">

### Author: ![Rodrigue\_ALAHASSA](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@Rodrigue\_ALAHASSA](https://community.zeek.org/u/Rodrigue_ALAHASSA)
#### Post date: [July 8, 2011, 8:40pm UTC](https://community.zeek.org/t/signature-payload-matching/1917/4 "2011-07-08T20:40:33Z")

</div>

What I wondered is why nothing is reported for test.sig.  
The payload is not the same, I do agree. But I don’t understand why it failed to detect it in the trafic.

Thanks in advance.

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/signature-payload-matching/1917/5 "2022-05-06T15:39:38Z")

</div>