# syslog events **URL:** \ **Category:** Zeek\ **Created:** [February 15, 2004, 11:24pm UTC](https://community.zeek.org/t/syslog-events/462 "2004-02-15T23:24:46Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [February 15, 2004, 11:24pm UTC](https://community.zeek.org/t/syslog-events/462/1 "2004-02-15T23:24:46Z")
> Possible receive bro events with syslog daemon ? That's not the Bro model. Events are meant to be processed by event handlers in your policy scripts. Those handlers might then decide to execute "log" statements (or by calling the ALERT() function, which is specified in policy/alert.bro), though, and \*those\* are sent via syslog. Note, an event is \*NOT\* an alert, it's a description of some network activity in security-neutral terms. > possible coding function to convert all events in same function ? > (and on this new function, choice syslog / stdout / stderr ...) Not in a policy script, since events are strongly typed. The tracing facility, "-t tracefile", let's you dump a list of all the events to a given file. Note, on any good-sized network stream, this file gets huge very fast.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/syslog-events/462/2 "2022-05-06T15:36:56Z")