# Signatures::LOG - rotation
**URL:** https://community.zeek.org/t/signatures-log-rotation/5970
**Category:** Zeek
**Created:** [January 15, 2020, 6:15pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970 "2020-01-15T18:15:36Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 15, 2020, 6:15pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/1 "2020-01-15T18:15:36Z")
hello members,
Please, can you help me
I have problem with log rotation for signature LOG (only)
when I use scripts ,
event zeek\_init()
{
local f = Log::get\_filter(Signatures::LOG, "default");
f$interv = 1 min;
Log::add\_filter(Signatures::LOG, f);
}
after run I have error.
expression error in /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line 579: no such index (Log::all\_streams[Log::id])
fatal error: errors occurred while initializing
The problem occurs in versions 3.0.1; 3.1.0-dev.376
Thank you , hello Zeek Team,
Please, can you help me
I have problem with log rotation for signature LOG (only)
when I use scripts ,
event zeek\_init()
{
local f = Log::get\_filter(Signatures::LOG, "default");
f$interv = 1 min;
Log::add\_filter(Signatures::LOG, f);
}
after run zeek a see error.
expression error in /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line 579: no such index (Log::all\_streams[Log::id])
fatal error: errors occurred while initializing
The problem occurs in versions 3.0.1; 3.1.0-dev.376
Thank you, for any help.
Adam
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)
#### Post date: [January 15, 2020, 7:18pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/2 "2020-01-15T19:18:32Z")
How exactly are you reproducing that?
I tried this:
==\> foo.sig \<==
signature foo {
ip-proto == tcp
tcp-state established,originator
event “hello”
payload /.\*hello/
}
==\> foo.zeek \<==
@load-sigs ./foo.sig
event zeek\_init()
{
local f = Log::get\_filter(Signatures::LOG, “default”);
f$interv = 30 secs;
Log::add\_filter(Signatures::LOG, f);
}
and just running zeek foo.zeek and after making 2 connections a minute apart ended up with 2 rotated log files.
---
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 15, 2020, 10:30pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/3 "2020-01-15T22:30:46Z")
Thank you for your response.
I did the test with your configuration and it works fine.
So I need to check my configuration carefully.
Thank you for your time
W dniu 15.01.2020 o 20:18, Justin Azoff pisze:
> How exactly are you reproducing that?
>
> I tried this:
>
> ==\> foo.sig \<==
> signature foo {
> ip-proto == tcp
> tcp-state established,originator
> event "hello"
> payload /.\*hello/
> }
>
> ==\> foo.zeek \<==
> @load-sigs ./foo.sig
> event zeek\_init()
> {
> local f = Log::get\_filter(Signatures::LOG, "default");
> f$interv = 30 secs;
> Log::add\_filter(Signatures::LOG, f);
> }
>
> and just running zeek foo.zeek and after making 2 connections a minute apart ended up with 2 rotated log files.
>
> hello members,
>
> Please, can you help me
>
> I have problem with log rotation for signature LOG (only)
>
> when I use scripts ,
>
> event zeek\_init()
> {
> local f = Log::get\_filter(Signatures::LOG, "default");
> f$interv = 1 min;
> Log::add\_filter(Signatures::LOG, f);
> }
>
> after run I have error.
>
> expression error in
> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line
> 579: no such index (Log::all\_streams[Log::id])
> fatal error: errors occurred while initializing
>
> The problem occurs in versions 3.0.1; 3.1.0-dev.376
>
> Thank you , hello Zeek Team,
> Please, can you help me
>
> I have problem with log rotation for signature LOG (only)
> when I use scripts ,
> event zeek\_init()
> {
> local f = Log::get\_filter(Signatures::LOG, "default");
> f$interv = 1 min;
> Log::add\_filter(Signatures::LOG, f);
> }
> after run zeek a see error.
> expression error in
> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line
> 579: no such index (Log::all\_streams[Log::id])
> fatal error: errors occurred while initializing
>
> The problem occurs in versions 3.0.1; 3.1.0-dev.376
>
> Thank you, for any help.
>
> Adam
>
> - - - - - - - - - - - - - - - - - - - -
>
> H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S
> L z a p o l o w e - k l a t k a . p l
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> Zeek mailing list
> zeek@zeek.org \
> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
>
> --
> Justin
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 17, 2020, 2:00pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/4 "2020-01-17T14:00:22Z")
hello,
I did some tests and something is wrong.
please see the sample configuration
==\> notice.zeek \<==
event zeek\_init()
{
local f = Log::get\_filter(Notice::LOG, "default");
f$interv = 1 min;
Log::add\_filter(Notice::LOG, f);
}
==\> dhcp.zeek \<==
event zeek\_init()
{
local f = Log::get\_filter(DHCP::LOG, "default");
f$interv = 1 min;
Log::add\_filter(DHCP::LOG, f);
}
==\> foo.sig \<==
signature foo {
ip-proto == tcp
tcp-state established,originator
event "hello"
payload /.\*hello/
}
==\> foo.zeek \<==
@load-sigs ./foo.sig
event zeek\_init()
{
local f = Log::get\_filter(Signatures::LOG, "default");
f$interv = 30 secs;
Log::add\_filter(Signatures::LOG, f);
}
==\> start.zeek \<==
@load ./notice.zeek
@load ./dhcp.zeek
@load ./foo.zeek
/usr/local/zeek/bin/zeek -r /var/pcap/zeek/pcap-2020-01-17-14-50-00.pcap ./start.zeek
expression error in /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line 579: no such index (Log::all\_streams[Log::id])
fatal error: errors occurred while initializing
when I make changes
#@load ./notice.zeek
@load ./dhcp.zeek
@load ./foo.zeek
or
@load ./notice.zeek
#@load ./dhcp.zeek
@load ./foo.zeek
or
@load ./notice.zeek
@load ./dhcp.zeek
#@load ./foo.zeek
no error occurs after running
Adam
W dniu 15.01.2020 o 23:30, os pisze:
> Thank you for your response.
> I did the test with your configuration and it works fine.
> So I need to check my configuration carefully.
>
> Thank you for your time
>
> W dniu 15.01.2020 o 20:18, Justin Azoff pisze:
>
> > How exactly are you reproducing that?
> >
> > I tried this:
> >
> > ==\> foo.sig \<==
> > signature foo {
> > ip-proto == tcp
> > tcp-state established,originator
> > event "hello"
> > payload /.\*hello/
> > }
> >
> > ==\> foo.zeek \<==
> > @load-sigs ./foo.sig
> > event zeek\_init()
> > {
> > local f = Log::get\_filter(Signatures::LOG, "default");
> > f$interv = 30 secs;
> > Log::add\_filter(Signatures::LOG, f);
> > }
> >
> > and just running zeek foo.zeek and after making 2 connections a minute
> > apart ended up with 2 rotated log files.
> >
> > hello members,
> >
> > Please, can you help me
> >
> > I have problem with log rotation for signature LOG (only)
> >
> > when I use scripts ,
> >
> > event zeek\_init()
> > {
> > local f = Log::get\_filter(Signatures::LOG, "default");
> > f$interv = 1 min;
> > Log::add\_filter(Signatures::LOG, f);
> > }
> >
> > after run I have error.
> >
> > expression error in
> > /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line
> > 579: no such index (Log::all\_streams[Log::id])
> > fatal error: errors occurred while initializing
> >
> > The problem occurs in versions 3.0.1; 3.1.0-dev.376
> >
> > Thank you , hello Zeek Team,
> > Please, can you help me
> >
> > I have problem with log rotation for signature LOG (only)
> > when I use scripts ,
> > event zeek\_init()
> > {
> > local f = Log::get\_filter(Signatures::LOG, "default");
> > f$interv = 1 min;
> > Log::add\_filter(Signatures::LOG, f);
> > }
> > after run zeek a see error.
> > expression error in
> > /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line
> > 579: no such index (Log::all\_streams[Log::id])
> > fatal error: errors occurred while initializing
> >
> > The problem occurs in versions 3.0.1; 3.1.0-dev.376
> >
> > Thank you, for any help.
> >
> > Adam
> >
> > - - - - - - - - - - - - - - - - - - - -
> >
> > H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S
> > L z a p o l o w e - k l a t k a . p l
> > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> > Zeek mailing list
> > zeek@zeek.org \
> > [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> >
> > --
> > Justin
>
> - - - - - - - - - - - - - - - - - - - -
>
> H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> Zeek mailing list
> zeek@zeek.org
> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)
#### Post date: [January 17, 2020, 2:27pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/5 "2020-01-17T14:27:08Z")
That still works for me. The error you are getting is from add\_filter failing to find a log stream with that ID, but Log::create\_stream is what creates that. I can make it fail like that if I mess with the priorities, like
event zeek\_init() &priority=100
{
local f = Log::get\_filter(DHCP::LOG, “default”);
f$interv = 1 min;
Log::add\_filter(DHCP::LOG, f);
}
which makes that run before the
event zeek\_init() &priority=5
{
Log::create\_stream(DHCP::LOG, [$columns=Info, $ev=log\_dhcp, $path=“dhcp”]);
Analyzer::register\_for\_ports(Analyzer::ANALYZER\_DHCP, ports);
}
in the dhcp script.
but with the default priorities I can’t see why that would fail.
---
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 17, 2020, 3:47pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/6 "2020-01-17T15:47:28Z")
very strange, becouse I didn't change priorities anywhere
W dniu 17.01.2020 o 15:27, Justin Azoff pisze:
> That still works for me. The error you are getting is from add\_filter failing to find a log stream with that ID, but Log::create\_stream is what creates that. I can make it fail like that if I mess with the priorities, like
>
> event zeek\_init() &priority=100
> {
> local f = Log::get\_filter(DHCP::LOG, "default");
> f$interv = 1 min;
> Log::add\_filter(DHCP::LOG, f);
> }
>
> which makes that run before the
>
> event zeek\_init() &priority=5
> {
> Log::create\_stream(DHCP::LOG, [$columns=Info, $ev=log\_dhcp, $path="dhcp"]);
> Analyzer::register\_for\_ports(Analyzer::ANALYZER\_DHCP, ports);
> }
>
> in the dhcp script.
>
> but with the default priorities I can't see why that would fail.
>
> hello,
>
> I did some tests and something is wrong.
> please see the sample configuration
>
> ==\> notice.zeek \<==
>
> event zeek\_init()
> {
> local f = Log::get\_filter(Notice::LOG, "default");
> f$interv = 1 min;
> Log::add\_filter(Notice::LOG, f);
> }
>
> ==\> dhcp.zeek \<==
>
> event zeek\_init()
> {
> local f = Log::get\_filter(DHCP::LOG, "default");
> f$interv = 1 min;
> Log::add\_filter(DHCP::LOG, f);
> }
>
> ==\> foo.sig \<==
> signature foo {
> ip-proto == tcp
> tcp-state established,originator
> event "hello"
> payload /.\*hello/
> }
>
> ==\> foo.zeek \<==
> @load-sigs ./foo.sig
> event zeek\_init()
> {
> local f = Log::get\_filter(Signatures::LOG, "default");
> f$interv = 30 secs;
> Log::add\_filter(Signatures::LOG, f);
> }
>
> ==\> start.zeek \<==
>
> @load ./notice.zeek
> @load ./dhcp.zeek
> @load ./foo.zeek
>
> /usr/local/zeek/bin/zeek -r
> /var/pcap/zeek/pcap-2020-01-17-14-50-00.pcap ./start.zeek
>
> expression error in
> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line
> 579: no such index (Log::all\_streams[Log::id])
> fatal error: errors occurred while initializing
>
> when I make changes
>
> #@load ./notice.zeek
> @load ./dhcp.zeek
> @load ./foo.zeek
>
> or
>
> @load ./notice.zeek
> #@load ./dhcp.zeek
> @load ./foo.zeek
>
> or
>
> @load ./notice.zeek
> @load ./dhcp.zeek
> #@load ./foo.zeek
>
> no error occurs after running
>
> Adam
>
> W dniu 15.01.2020 o 23:30, os pisze:
> \> Thank you for your response.
> \> I did the test with your configuration and it works fine.
> \> So I need to check my configuration carefully.
> \>
> \> Thank you for your time
> \>
> \> W dniu 15.01.2020 o 20:18, Justin Azoff pisze:
> \>\> How exactly are you reproducing that?
> \>\>
> \>\> I tried this:
> \>\>
> \>\> ==\> foo.sig \<==
> \>\> signature foo {
> \>\> ip-proto == tcp
> \>\> tcp-state established,originator
> \>\> event "hello"
> \>\> payload /.\*hello/
> \>\> }
> \>\>
> \>\> ==\> foo.zeek \<==
> \>\> @load-sigs ./foo.sig
> \>\> event zeek\_init()
> \>\> {
> \>\> local f = Log::get\_filter(Signatures::LOG, "default");
> \>\> f$interv = 30 secs;
> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> }
> \>\>
> \>\> and just running zeek foo.zeek and after making 2 connections a
> minute
> \>\> apart ended up with 2 rotated log files.
> \>\>
> \>\> hello members,
> \>\>
> \>\> Please, can you help me
> \>\>
> \>\> I have problem with log rotation for signature LOG (only)
> \>\>
> \>\> when I use scripts ,
> \>\>
> \>\> event zeek\_init()
> \>\> {
> \>\> local f = Log::get\_filter(Signatures::LOG,
> "default");
> \>\> f$interv = 1 min;
> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> }
> \>\>
> \>\> after run I have error.
> \>\>
> \>\> expression error in
> \>\> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> line
> \>\> 579: no such index (Log::all\_streams[Log::id])
> \>\> fatal error: errors occurred while initializing
> \>\>
> \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> \>\>
> \>\> Thank you , hello Zeek Team,
> \>\> Please, can you help me
> \>\>
> \>\> I have problem with log rotation for signature LOG (only)
> \>\> when I use scripts ,
> \>\> event zeek\_init()
> \>\> {
> \>\> local f = Log::get\_filter(Signatures::LOG, "default");
> \>\> f$interv = 1 min;
> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> }
> \>\> after run zeek a see error.
> \>\> expression error in
> \>\> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> line
> \>\> 579: no such index (Log::all\_streams[Log::id])
> \>\> fatal error: errors occurred while initializing
> \>\>
> \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> \>\>
> \>\> Thank you, for any help.
> \>\>
> \>\> Adam
> \>\>
> \>\> - - - - - - - - - - - - - - - - - - - -
> \>\>
> \>\> H o s t i n g z d a r m o w y m c e r t y f i k a t
> e m S S
> \>\> L z a p o l o w e - k l a t k a . p l
> \>\> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \>\> Zeek mailing list
> \>\> zeek@zeek.org \ \ \\>
> \>\> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> \>\>
> \>\> --
> \>\> Justin
> \>
> \> - - - - - - - - - - - - - - - - - - - -
> \>
> \> H o s t i n g z d a r m o w y m c e r t y f i k a t e m
> S S L z a p o l o w e - k l a t k a . p l
> \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \> Zeek mailing list
> \> zeek@zeek.org \
> \> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
>
> - - - - - - - - - - - - - - - - - - - -
>
> H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S
> L z a p o l o w e - k l a t k a . p l
>
> --
> Justin
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 17, 2020, 7:02pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/7 "2020-01-17T19:02:10Z")
hello,
I changed the priority in the file and it looks like it works
/usr/local/zeek/share/zeek/base/frameworks/signatures/main.zeek
event zeek\_init() &priority=5
{
Log::create\_stream(Signatures::LOG, [$columns=Info, $ev=log\_signature, $path="signatures"]);
}
Thank you for your help and time
W dniu 17.01.2020 o 16:47, os pisze:
> very strange, becouse I didn't change priorities anywhere
>
> W dniu 17.01.2020 o 15:27, Justin Azoff pisze:
>
> > That still works for me. The error you are getting is from add\_filter
> > failing to find a log stream with that ID, but Log::create\_stream is
> > what creates that. I can make it fail like that if I mess with the
> > priorities, like
> >
> > event zeek\_init() &priority=100
> > {
> > local f = Log::get\_filter(DHCP::LOG, "default");
> > f$interv = 1 min;
> > Log::add\_filter(DHCP::LOG, f);
> > }
> >
> > which makes that run before the
> >
> > event zeek\_init() &priority=5
> > {
> > Log::create\_stream(DHCP::LOG, [$columns=Info, $ev=log\_dhcp,
> > $path="dhcp"]);
> > Analyzer::register\_for\_ports(Analyzer::ANALYZER\_DHCP, ports);
> > }
> >
> > in the dhcp script.
> >
> > but with the default priorities I can't see why that would fail.
> >
> > hello,
> >
> > I did some tests and something is wrong.
> > please see the sample configuration
> >
> > ==\> notice.zeek \<==
> >
> > event zeek\_init()
> > {
> > local f = Log::get\_filter(Notice::LOG, "default");
> > f$interv = 1 min;
> > Log::add\_filter(Notice::LOG, f);
> > }
> >
> > ==\> dhcp.zeek \<==
> >
> > event zeek\_init()
> > {
> > local f = Log::get\_filter(DHCP::LOG, "default");
> > f$interv = 1 min;
> > Log::add\_filter(DHCP::LOG, f);
> > }
> >
> > ==\> foo.sig \<==
> > signature foo {
> > ip-proto == tcp
> > tcp-state established,originator
> > event "hello"
> > payload /.\*hello/
> > }
> >
> > ==\> foo.zeek \<==
> > @load-sigs ./foo.sig
> > event zeek\_init()
> > {
> > local f = Log::get\_filter(Signatures::LOG, "default");
> > f$interv = 30 secs;
> > Log::add\_filter(Signatures::LOG, f);
> > }
> >
> > ==\> start.zeek \<==
> >
> > @load ./notice.zeek
> > @load ./dhcp.zeek
> > @load ./foo.zeek
> >
> > /usr/local/zeek/bin/zeek -r
> > /var/pcap/zeek/pcap-2020-01-17-14-50-00.pcap ./start.zeek
> >
> > expression error in
> > /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line
> > 579: no such index (Log::all\_streams[Log::id])
> > fatal error: errors occurred while initializing
> >
> > when I make changes
> >
> > #@load ./notice.zeek
> > @load ./dhcp.zeek
> > @load ./foo.zeek
> >
> > or
> >
> > @load ./notice.zeek
> > #@load ./dhcp.zeek
> > @load ./foo.zeek
> >
> > or
> >
> > @load ./notice.zeek
> > @load ./dhcp.zeek
> > #@load ./foo.zeek
> >
> > no error occurs after running
> >
> > Adam
> >
> > W dniu 15.01.2020 o 23:30, os pisze:
> > \> Thank you for your response.
> > \> I did the test with your configuration and it works fine.
> > \> So I need to check my configuration carefully.
> > \>
> > \> Thank you for your time
> > \>
> > \> W dniu 15.01.2020 o 20:18, Justin Azoff pisze:
> > \>\> How exactly are you reproducing that?
> > \>\>
> > \>\> I tried this:
> > \>\>
> > \>\> ==\> foo.sig \<==
> > \>\> signature foo {
> > \>\> ip-proto == tcp
> > \>\> tcp-state established,originator
> > \>\> event "hello"
> > \>\> payload /.\*hello/
> > \>\> }
> > \>\>
> > \>\> ==\> foo.zeek \<==
> > \>\> @load-sigs ./foo.sig
> > \>\> event zeek\_init()
> > \>\> {
> > \>\> local f = Log::get\_filter(Signatures::LOG, "default");
> > \>\> f$interv = 30 secs;
> > \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> }
> > \>\>
> > \>\> and just running zeek foo.zeek and after making 2 connections a
> > minute
> > \>\> apart ended up with 2 rotated log files.
> > \>\>
> > \>\> hello members,
> > \>\>
> > \>\> Please, can you help me
> > \>\>
> > \>\> I have problem with log rotation for signature LOG (only)
> > \>\>
> > \>\> when I use scripts ,
> > \>\>
> > \>\> event zeek\_init()
> > \>\> {
> > \>\> local f = Log::get\_filter(Signatures::LOG,
> > "default");
> > \>\> f$interv = 1 min;
> > \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> }
> > \>\>
> > \>\> after run I have error.
> > \>\>
> > \>\> expression error in
> > \>\> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> > line
> > \>\> 579: no such index (Log::all\_streams[Log::id])
> > \>\> fatal error: errors occurred while initializing
> > \>\>
> > \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> > \>\>
> > \>\> Thank you , hello Zeek Team,
> > \>\> Please, can you help me
> > \>\>
> > \>\> I have problem with log rotation for signature LOG (only)
> > \>\> when I use scripts ,
> > \>\> event zeek\_init()
> > \>\> {
> > \>\> local f = Log::get\_filter(Signatures::LOG, "default");
> > \>\> f$interv = 1 min;
> > \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> }
> > \>\> after run zeek a see error.
> > \>\> expression error in
> > \>\> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> > line
> > \>\> 579: no such index (Log::all\_streams[Log::id])
> > \>\> fatal error: errors occurred while initializing
> > \>\>
> > \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> > \>\>
> > \>\> Thank you, for any help.
> > \>\>
> > \>\> Adam
> > \>\>
> > \>\> - - - - - - - - - - - - - - - - - - - -
> > \>\>
> > \>\> H o s t i n g z d a r m o w y m c e r t y f i k a t
> > e m S S
> > \>\> L z a p o l o w e - k l a t k a . p l
> > \>\> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> > \>\> Zeek mailing list
> > \>\> zeek@zeek.org \ \ > \\>
> > \>\> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> > \>\>
> > \>\> --
> > \>\> Justin
> > \>
> > \> - - - - - - - - - - - - - - - - - - - -
> > \>
> > \> H o s t i n g z d a r m o w y m c e r t y f i k a t e m
> > S S L z a p o l o w e - k l a t k a . p l
> > \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> > \> Zeek mailing list
> > \> zeek@zeek.org \
> > \> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> >
> > - - - - - - - - - - - - - - - - - - - -
> >
> > H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S
> > L z a p o l o w e - k l a t k a . p l
> >
> > --
> > Justin
>
> - - - - - - - - - - - - - - - - - - - -
>
> H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> Zeek mailing list
> zeek@zeek.org
> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)
#### Post date: [January 17, 2020, 7:59pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/8 "2020-01-17T19:59:36Z")
Ah, you should change yours to -5, don’t modify the shipped scripts.
I think that change is correct though and that this is a bug in the signatures script.
running this, I can see that almost every script sets a priority of 5 for the zeek\_init event:
fgrep -r Log::create\_str scripts/ -B 2|grep ‘event zeek\_init’
there are only 3 that don’t:
scripts//base/frameworks/signatures/main.zeek-event zeek\_init()
scripts//policy/files/x509/log-ocsp.zeek-event zeek\_init()
scripts//policy/protocols/conn/known-hosts.zeek-event zeek\_init()
which explains why you were having this problem… without a priority the default is 0, and the two events will run in an undefined order… for me they were running in the order that worked, for you they were running in the other order and you were hitting the bug.
---
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 24, 2020, 10:12am UTC](https://community.zeek.org/t/signatures-log-rotation/5970/9 "2020-01-24T10:12:31Z")
hello,
Another problem with the log file format - default settings
ntp-20-01-24\_10.22.34.log
notice.2020-01-24-10-23-00.log
Thank you for your help and time
W dniu 17.01.2020 o 20:59, Justin Azoff pisze:
> Ah, you should change yours to -5, don't modify the shipped scripts.
>
> I think that change is correct though and that this is a bug in the signatures script.
>
> running this, I can see that almost every script sets a priority of 5 for the zeek\_init event:
>
> ```
> fgrep \-r Log::create\_str scripts/ \-B 2|grep 'event zeek\_init'
>
> ```
>
> there are only 3 that don't:
>
> scripts//base/frameworks/signatures/main.zeek-event zeek\_init()
> scripts//policy/files/x509/log-ocsp.zeek-event zeek\_init()
> scripts//policy/protocols/conn/known-hosts.zeek-event zeek\_init()
>
> which explains why you were having this problem.. without a priority the default is 0, and the two events will run in an undefined order.. for me they were running in the order that worked, for you they were running in the other order and you were hitting the bug.
>
> hello,
>
> I changed the priority in the file and it looks like it works
>
> /usr/local/zeek/share/zeek/base/frameworks/signatures/main.zeek
>
> event zeek\_init() &priority=5
>
> {
>
> Log::create\_stream(Signatures::LOG, [$columns=Info,
> $ev=log\_signature,
> $path="signatures"]);
>
> }
>
> Thank you for your help and time
>
> W dniu 17.01.2020 o 16:47, os pisze:
> \> very strange, becouse I didn't change priorities anywhere
> \>
> \> W dniu 17.01.2020 o 15:27, Justin Azoff pisze:
> \>\> That still works for me. The error you are getting is from
> add\_filter
> \>\> failing to find a log stream with that ID,
> but Log::create\_stream is
> \>\> what creates that. I can make it fail like that if I mess with the
> \>\> priorities, like
> \>\>
> \>\> event zeek\_init() &priority=100
> \>\> {
> \>\> local f = Log::get\_filter(DHCP::LOG, "default");
> \>\> f$interv = 1 min;
> \>\> Log::add\_filter(DHCP::LOG, f);
> \>\> }
> \>\>
> \>\> which makes that run before the
> \>\>
> \>\> event zeek\_init() &priority=5
> \>\> {
> \>\> Log::create\_stream(DHCP::LOG, [$columns=Info, $ev=log\_dhcp,
> \>\> $path="dhcp"]);
> \>\> Analyzer::register\_for\_ports(Analyzer::ANALYZER\_DHCP, ports);
> \>\> }
> \>\>
> \>\> in the dhcp script.
> \>\>
> \>\> but with the default priorities I can't see why that would fail.
> \>\>
> \>\> hello,
> \>\>
> \>\> I did some tests and something is wrong.
> \>\> please see the sample configuration
> \>\>
> \>\> ==\> notice.zeek \<==
> \>\>
> \>\> event zeek\_init()
> \>\> {
> \>\> local f = Log::get\_filter(Notice::LOG, "default");
> \>\> f$interv = 1 min;
> \>\> Log::add\_filter(Notice::LOG, f);
> \>\> }
> \>\>
> \>\> ==\> dhcp.zeek \<==
> \>\>
> \>\> event zeek\_init()
> \>\> {
> \>\> local f = Log::get\_filter(DHCP::LOG, "default");
> \>\> f$interv = 1 min;
> \>\> Log::add\_filter(DHCP::LOG, f);
> \>\> }
> \>\>
> \>\> ==\> foo.sig \<==
> \>\> signature foo {
> \>\> ip-proto == tcp
> \>\> tcp-state established,originator
> \>\> event "hello"
> \>\> payload /.\*hello/
> \>\> }
> \>\>
> \>\> ==\> foo.zeek \<==
> \>\> @load-sigs ./foo.sig
> \>\> event zeek\_init()
> \>\> {
> \>\> local f = Log::get\_filter(Signatures::LOG, "default");
> \>\> f$interv = 30 secs;
> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> }
> \>\>
> \>\> ==\> start.zeek \<==
> \>\>
> \>\> @load ./notice.zeek
> \>\> @load ./dhcp.zeek
> \>\> @load ./foo.zeek
> \>\>
> \>\> /usr/local/zeek/bin/zeek -r
> \>\> /var/pcap/zeek/pcap-2020-01-17-14-50-00.pcap ./start.zeek
> \>\>
> \>\> expression error in
> \>\> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> line
> \>\> 579: no such index (Log::all\_streams[Log::id])
> \>\> fatal error: errors occurred while initializing
> \>\>
> \>\> when I make changes
> \>\>
> \>\> #@load ./notice.zeek
> \>\> @load ./dhcp.zeek
> \>\> @load ./foo.zeek
> \>\>
> \>\> or
> \>\>
> \>\> @load ./notice.zeek
> \>\> #@load ./dhcp.zeek
> \>\> @load ./foo.zeek
> \>\>
> \>\> or
> \>\>
> \>\> @load ./notice.zeek
> \>\> @load ./dhcp.zeek
> \>\> #@load ./foo.zeek
> \>\>
> \>\> no error occurs after running
> \>\>
> \>\> Adam
> \>\>
> \>\> W dniu 15.01.2020 o 23:30, os pisze:
> \>\> \> Thank you for your response.
> \>\> \> I did the test with your configuration and it works fine.
> \>\> \> So I need to check my configuration carefully.
> \>\> \>
> \>\> \> Thank you for your time
> \>\> \>
> \>\> \> W dniu 15.01.2020 o 20:18, Justin Azoff pisze:
> \>\> \>\> How exactly are you reproducing that?
> \>\> \>\>
> \>\> \>\> I tried this:
> \>\> \>\>
> \>\> \>\> ==\> foo.sig \<==
> \>\> \>\> signature foo {
> \>\> \>\> ip-proto == tcp
> \>\> \>\> tcp-state established,originator
> \>\> \>\> event "hello"
> \>\> \>\> payload /.\*hello/
> \>\> \>\> }
> \>\> \>\>
> \>\> \>\> ==\> foo.zeek \<==
> \>\> \>\> @load-sigs ./foo.sig
> \>\> \>\> event zeek\_init()
> \>\> \>\> {
> \>\> \>\> local f = Log::get\_filter(Signatures::LOG,
> "default");
> \>\> \>\> f$interv = 30 secs;
> \>\> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> \>\> }
> \>\> \>\>
> \>\> \>\> and just running zeek foo.zeek and after making 2
> connections a
> \>\> minute
> \>\> \>\> apart ended up with 2 rotated log files.
> \>\> \>\>
> \>\> \>\> On Wed, Jan 15, 2020 at 1:18 PM os \ \
> \>\> \
> \ \\>\>\>
> \>\> \>\> wrote:
> \>\> \>\>
> \>\> \>\> hello members,
> \>\> \>\>
> \>\> \>\> Please, can you help me
> \>\> \>\>
> \>\> \>\> I have problem with log rotation for signature LOG
> (only)
> \>\> \>\>
> \>\> \>\> when I use scripts ,
> \>\> \>\>
> \>\> \>\> event zeek\_init()
> \>\> \>\> {
> \>\> \>\> local f = Log::get\_filter(Signatures::LOG,
> \>\> "default");
> \>\> \>\> f$interv = 1 min;
> \>\> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> \>\> }
> \>\> \>\>
> \>\> \>\> after run I have error.
> \>\> \>\>
> \>\> \>\> expression error in
> \>\> \>\>
> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> \>\> line
> \>\> \>\> 579: no such index (Log::all\_streams[Log::id])
> \>\> \>\> fatal error: errors occurred while initializing
> \>\> \>\>
> \>\> \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> \>\> \>\>
> \>\> \>\> Thank you , hello Zeek Team,
> \>\> \>\> Please, can you help me
> \>\> \>\>
> \>\> \>\> I have problem with log rotation for signature LOG
> (only)
> \>\> \>\> when I use scripts ,
> \>\> \>\> event zeek\_init()
> \>\> \>\> {
> \>\> \>\> local f = Log::get\_filter(Signatures::LOG,
> "default");
> \>\> \>\> f$interv = 1 min;
> \>\> \>\> Log::add\_filter(Signatures::LOG, f);
> \>\> \>\> }
> \>\> \>\> after run zeek a see error.
> \>\> \>\> expression error in
> \>\> \>\>
> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> \>\> line
> \>\> \>\> 579: no such index (Log::all\_streams[Log::id])
> \>\> \>\> fatal error: errors occurred while initializing
> \>\> \>\>
> \>\> \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> \>\> \>\>
> \>\> \>\> Thank you, for any help.
> \>\> \>\>
> \>\> \>\> Adam
> \>\> \>\>
> \>\> \>\> - - - - - - - - - - - - - - - - - - - -
> \>\> \>\>
> \>\> \>\> H o s t i n g z d a r m o w y m c e r t y f
> i k a t
> \>\> e m S S
> \>\> \>\> L z a p o l o w e - k l a t k a . p l
> \>\> \>\> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \>\> \>\> Zeek mailing list
> \>\> \>\> zeek@zeek.org \
> \
> \ \>\> \\>
> \>\> \>\> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> \>\> \>\>
> \>\> \>\> --
> \>\> \>\> Justin
> \>\> \>
> \>\> \> - - - - - - - - - - - - - - - - - - - -
> \>\> \>
> \>\> \> H o s t i n g z d a r m o w y m c e r t y f i k a
> t e m
> \>\> S S L z a p o l o w e - k l a t k a . p l
> \>\> \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \>\> \> Zeek mailing list
> \>\> \> zeek@zeek.org \
> \
> \>\> \> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> \>\>
> \>\> - - - - - - - - - - - - - - - - - - - -
> \>\>
> \>\> H o s t i n g z d a r m o w y m c e r t y f i k a t
> e m S S
> \>\> L z a p o l o w e - k l a t k a . p l
> \>\>
> \>\> --
> \>\> Justin
> \>
> \> - - - - - - - - - - - - - - - - - - - -
> \>
> \> H o s t i n g z d a r m o w y m c e r t y f i k a t e m
> S S L z a p o l o w e - k l a t k a . p l
> \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> \> Zeek mailing list
> \> zeek@zeek.org \
> \> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
>
> - - - - - - - - - - - - - - - - - - - -
>
> H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S
> L z a p o l o w e - k l a t k a . p l
>
> --
> Justin
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@os1](https://community.zeek.org/u/os1)
#### Post date: [January 27, 2020, 9:26am UTC](https://community.zeek.org/t/signatures-log-rotation/5970/10 "2020-01-27T09:26:27Z")
I'm a bit confused and I don't understand why this is happening.
I changed :default\_rotation\_date\_format
redef Log::default\_rotation\_date\_format="%y-%m-%d\_%H.%M.%S";
and the output log file have diffrent format, which in turn generates an error
signatures.20-01-24\_10.23.00.log
notice-20-01-24\_10.22.34.log
/bin/mv: cannot stat 'signatures-20-01-24\_10.23.00.log': No such file or director
disable
#redef Log::default\_rotation\_date\_format="%y-%m-%d\_%H.%M.%S";
default settings
Log::default\_rotation\_date\_format
Type: string
Attributes: &redef
Default: "%Y-%m-%d-%H-%M-%S"
output file:
dns-20-01-24\_10.22.44.log
ntp-20-01-24\_10.22.34.log
signatures.2020-01-24-10-23-00.log
notice-20-01-24\_10.22.34.log
ntp-20-01-24\_10.23.00.log
weird-20-01-24\_10.22.34.log
and error
/bin/mv: cannot stat 'signatures-20-01-24\_10.23.00.log': No such file or directory
what does the output file format depend on once is "-" and once is "."
Thank you for answers.
Adam
W dniu 24.01.2020 o 11:12, os pisze:
> hello,
>
> Another problem with the log file format - default settings
> ntp-20-01-24\_10.22.34.log
> notice.2020-01-24-10-23-00.log
>
> Thank you for your help and time
>
> W dniu 17.01.2020 o 20:59, Justin Azoff pisze:
>
> > Ah, you should change yours to -5, don't modify the shipped scripts.
> >
> > I think that change is correct though and that this is a bug in the
> > signatures script.
> >
> > running this, I can see that almost every script sets a priority of 5
> > for the zeek\_init event:
> >
> > ```
> > fgrep \-r Log::create\_str scripts/ \-B 2|grep 'event zeek\_init'
> >
> > ```
> >
> > there are only 3 that don't:
> >
> > scripts//base/frameworks/signatures/main.zeek-event zeek\_init()
> > scripts//policy/files/x509/log-ocsp.zeek-event zeek\_init()
> > scripts//policy/protocols/conn/known-hosts.zeek-event zeek\_init()
> >
> > which explains why you were having this problem.. without a priority
> > the default is 0, and the two events will run in an undefined order..
> > for me they were running in the order that worked, for you they were
> > running in the other order and you were hitting the bug.
> >
> > hello,
> >
> > I changed the priority in the file and it looks like it works
> >
> > /usr/local/zeek/share/zeek/base/frameworks/signatures/main.zeek
> >
> > event zeek\_init() &priority=5
> >
> > {
> >
> > Log::create\_stream(Signatures::LOG, [$columns=Info,
> > $ev=log\_signature,
> > $path="signatures"]);
> >
> > }
> >
> > Thank you for your help and time
> >
> > W dniu 17.01.2020 o 16:47, os pisze:
> > \> very strange, becouse I didn't change priorities anywhere
> > \>
> > \> W dniu 17.01.2020 o 15:27, Justin Azoff pisze:
> > \>\> That still works for me. The error you are getting is from
> > add\_filter
> > \>\> failing to find a log stream with that ID,
> > but Log::create\_stream is
> > \>\> what creates that. I can make it fail like that if I mess with the
> > \>\> priorities, like
> > \>\>
> > \>\> event zeek\_init() &priority=100
> > \>\> {
> > \>\> local f = Log::get\_filter(DHCP::LOG, "default");
> > \>\> f$interv = 1 min;
> > \>\> Log::add\_filter(DHCP::LOG, f);
> > \>\> }
> > \>\>
> > \>\> which makes that run before the
> > \>\>
> > \>\> event zeek\_init() &priority=5
> > \>\> {
> > \>\> Log::create\_stream(DHCP::LOG, [$columns=Info, $ev=log\_dhcp,
> > \>\> $path="dhcp"]);
> > \>\> Analyzer::register\_for\_ports(Analyzer::ANALYZER\_DHCP, ports);
> > \>\> }
> > \>\>
> > \>\> in the dhcp script.
> > \>\>
> > \>\> but with the default priorities I can't see why that would fail.
> > \>\>
> > \>\> hello,
> > \>\>
> > \>\> I did some tests and something is wrong.
> > \>\> please see the sample configuration
> > \>\>
> > \>\> ==\> notice.zeek \<==
> > \>\>
> > \>\> event zeek\_init()
> > \>\> {
> > \>\> local f = Log::get\_filter(Notice::LOG, "default");
> > \>\> f$interv = 1 min;
> > \>\> Log::add\_filter(Notice::LOG, f);
> > \>\> }
> > \>\>
> > \>\> ==\> dhcp.zeek \<==
> > \>\>
> > \>\> event zeek\_init()
> > \>\> {
> > \>\> local f = Log::get\_filter(DHCP::LOG, "default");
> > \>\> f$interv = 1 min;
> > \>\> Log::add\_filter(DHCP::LOG, f);
> > \>\> }
> > \>\>
> > \>\> ==\> foo.sig \<==
> > \>\> signature foo {
> > \>\> ip-proto == tcp
> > \>\> tcp-state established,originator
> > \>\> event "hello"
> > \>\> payload /.\*hello/
> > \>\> }
> > \>\>
> > \>\> ==\> foo.zeek \<==
> > \>\> @load-sigs ./foo.sig
> > \>\> event zeek\_init()
> > \>\> {
> > \>\> local f = Log::get\_filter(Signatures::LOG, "default");
> > \>\> f$interv = 30 secs;
> > \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> }
> > \>\>
> > \>\> ==\> start.zeek \<==
> > \>\>
> > \>\> @load ./notice.zeek
> > \>\> @load ./dhcp.zeek
> > \>\> @load ./foo.zeek
> > \>\>
> > \>\> /usr/local/zeek/bin/zeek -r
> > \>\> /var/pcap/zeek/pcap-2020-01-17-14-50-00.pcap ./start.zeek
> > \>\>
> > \>\> expression error in
> > \>\> /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> > line
> > \>\> 579: no such index (Log::all\_streams[Log::id])
> > \>\> fatal error: errors occurred while initializing
> > \>\>
> > \>\> when I make changes
> > \>\>
> > \>\> #@load ./notice.zeek
> > \>\> @load ./dhcp.zeek
> > \>\> @load ./foo.zeek
> > \>\>
> > \>\> or
> > \>\>
> > \>\> @load ./notice.zeek
> > \>\> #@load ./dhcp.zeek
> > \>\> @load ./foo.zeek
> > \>\>
> > \>\> or
> > \>\>
> > \>\> @load ./notice.zeek
> > \>\> @load ./dhcp.zeek
> > \>\> #@load ./foo.zeek
> > \>\>
> > \>\> no error occurs after running
> > \>\>
> > \>\> Adam
> > \>\>
> > \>\> W dniu 15.01.2020 o 23:30, os pisze:
> > \>\> \> Thank you for your response.
> > \>\> \> I did the test with your configuration and it works fine.
> > \>\> \> So I need to check my configuration carefully.
> > \>\> \>
> > \>\> \> Thank you for your time
> > \>\> \>
> > \>\> \> W dniu 15.01.2020 o 20:18, Justin Azoff pisze:
> > \>\> \>\> How exactly are you reproducing that?
> > \>\> \>\>
> > \>\> \>\> I tried this:
> > \>\> \>\>
> > \>\> \>\> ==\> foo.sig \<==
> > \>\> \>\> signature foo {
> > \>\> \>\> ip-proto == tcp
> > \>\> \>\> tcp-state established,originator
> > \>\> \>\> event "hello"
> > \>\> \>\> payload /.\*hello/
> > \>\> \>\> }
> > \>\> \>\>
> > \>\> \>\> ==\> foo.zeek \<==
> > \>\> \>\> @load-sigs ./foo.sig
> > \>\> \>\> event zeek\_init()
> > \>\> \>\> {
> > \>\> \>\> local f = Log::get\_filter(Signatures::LOG,
> > "default");
> > \>\> \>\> f$interv = 30 secs;
> > \>\> \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> \>\> }
> > \>\> \>\>
> > \>\> \>\> and just running zeek foo.zeek and after making 2
> > connections a
> > \>\> minute
> > \>\> \>\> apart ended up with 2 rotated log files.
> > \>\> \>\>
> > \>\> \>\> On Wed, Jan 15, 2020 at 1:18 PM os \ > \
> > \>\> \
> > \ > \\>\>\>
> > \>\> \>\> wrote:
> > \>\> \>\>
> > \>\> \>\> hello members,
> > \>\> \>\>
> > \>\> \>\> Please, can you help me
> > \>\> \>\>
> > \>\> \>\> I have problem with log rotation for signature LOG
> > (only)
> > \>\> \>\>
> > \>\> \>\> when I use scripts ,
> > \>\> \>\>
> > \>\> \>\> event zeek\_init()
> > \>\> \>\> {
> > \>\> \>\> local f = Log::get\_filter(Signatures::LOG,
> > \>\> "default");
> > \>\> \>\> f$interv = 1 min;
> > \>\> \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> \>\> }
> > \>\> \>\>
> > \>\> \>\> after run I have error.
> > \>\> \>\>
> > \>\> \>\> expression error in
> > \>\> \>\>
> > /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> > \>\> line
> > \>\> \>\> 579: no such index (Log::all\_streams[Log::id])
> > \>\> \>\> fatal error: errors occurred while initializing
> > \>\> \>\>
> > \>\> \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> > \>\> \>\>
> > \>\> \>\> Thank you , hello Zeek Team,
> > \>\> \>\> Please, can you help me
> > \>\> \>\>
> > \>\> \>\> I have problem with log rotation for signature LOG
> > (only)
> > \>\> \>\> when I use scripts ,
> > \>\> \>\> event zeek\_init()
> > \>\> \>\> {
> > \>\> \>\> local f = Log::get\_filter(Signatures::LOG,
> > "default");
> > \>\> \>\> f$interv = 1 min;
> > \>\> \>\> Log::add\_filter(Signatures::LOG, f);
> > \>\> \>\> }
> > \>\> \>\> after run zeek a see error.
> > \>\> \>\> expression error in
> > \>\> \>\>
> > /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek,
> > \>\> line
> > \>\> \>\> 579: no such index (Log::all\_streams[Log::id])
> > \>\> \>\> fatal error: errors occurred while initializing
> > \>\> \>\>
> > \>\> \>\> The problem occurs in versions 3.0.1; 3.1.0-dev.376
> > \>\> \>\>
> > \>\> \>\> Thank you, for any help.
> > \>\> \>\>
> > \>\> \>\> Adam
> > \>\> \>\>
> > \>\> \>\> - - - - - - - - - - - - - - - - - - - -
> > \>\> \>\>
> > \>\> \>\> H o s t i n g z d a r m o w y m c e r t y f
> > i k a t
> > \>\> e m S S
> > \>\> \>\> L z a p o l o w e - k l a t k a . p l
> > \>\> \>\> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> > \>\> \>\> Zeek mailing list
> > \>\> \>\> zeek@zeek.org \
> > \
> > \ > \>\> \\>
> > \>\> \>\> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> > \>\> \>\>
> > \>\> \>\> --
> > \>\> \>\> Justin
> > \>\> \>
> > \>\> \> - - - - - - - - - - - - - - - - - - - -
> > \>\> \>
> > \>\> \> H o s t i n g z d a r m o w y m c e r t y f i k a
> > t e m
> > \>\> S S L z a p o l o w e - k l a t k a . p l
> > \>\> \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> > \>\> \> Zeek mailing list
> > \>\> \> zeek@zeek.org \
> > \
> > \>\> \> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> > \>\>
> > \>\> - - - - - - - - - - - - - - - - - - - -
> > \>\>
> > \>\> H o s t i n g z d a r m o w y m c e r t y f i k a t
> > e m S S
> > \>\> L z a p o l o w e - k l a t k a . p l
> > \>\>
> > \>\> --
> > \>\> Justin
> > \>
> > \> - - - - - - - - - - - - - - - - - - - -
> > \>
> > \> H o s t i n g z d a r m o w y m c e r t y f i k a t e m
> > S S L z a p o l o w e - k l a t k a . p l
> > \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> > \> Zeek mailing list
> > \> zeek@zeek.org \
> > \> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
> >
> > - - - - - - - - - - - - - - - - - - - -
> >
> > H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S
> > L z a p o l o w e - k l a t k a . p l
> >
> > --
> > Justin
>
> - - - - - - - - - - - - - - - - - - - -
>
> H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
> Zeek mailing list
> zeek@zeek.org
> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek)
- - - - - - - - - - - - - - - - - - - -
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l
---
### Author:  [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [January 29, 2020, 11:06pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/11 "2020-01-29T23:06:31Z")
Just as a small followup - to close the circle on this - this was fixed in master and will be part of 3.1.0:
>
>
> Typically in base scripts, Log::create\_stream() is called in zeek\_init()
> handle…r with &priority=5 such that it will have already been created
> in the default zeek\_init() &priority=0.
>
> Pitfall caused by the current inconsistency reported via thread: http://mailman.icsi.berkeley.edu/pipermail/zeek/2020-January/014941.html
Johanna
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/signatures-log-rotation/5970/12 "2022-05-06T15:47:00Z")