Hello everyone, I have a bro script that logs events based on a blacklist, but I don’t want to log the same IP - blacklisted item twice. I was thinking I could log the data using the SQLite writer, and then also read from that database checking if the event has been logged earlier. Has anyone used …

A different approach here is probably better. What is your timeframe for not logging something twice? Forever? or would once a day be ok?

If you are raising a notice, you can use suppression that is built in: https://www.bro.org/sphinx-git/frameworks/notice.html#automated-suppression otherwise see how the known hosts policy does it: https://www.bro.org/sphinx/_downloads/known-hosts.bro

We do not use the notice log in this instance, but using the &synchronized and &create_expire attributes look perfect for what I’m trying to accomplish, and significantly easier to use, haha. Thanks Justin!

SQLite logging and as white/blacklist in a cluster

Zeek

Topic		Replies	Views
Using the sqlite logger in cluster mode Zeek	1	105	May 6, 2022
Multiple logs in one SQLite database Development development	3	151	May 6, 2022
logger node in a cluster Zeek	2	156	May 6, 2022
Logging to SQLite only writes to one file Zeek	1	95	May 6, 2022
multiple sqlite writers Zeek	3	142	May 6, 2022

SQLite logging and as white/blacklist in a cluster

Related topics