# Tuning Bro

**URL:** <https://community.zeek.org/t/tuning-bro/4421>\
**Category:** Zeek\
**Created:** [October 19, 2016, 9:03am UTC](https://community.zeek.org/t/tuning-bro/4421 "2016-10-19T09:03:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sec-x\_sec-x](https://avatars.discourse-cdn.com/v4/letter/s/4af34b/32.png) [@sec-x\_sec-x](https://community.zeek.org/u/sec-x_sec-x)\
**Post date:** [October 19, 2016, 9:03am UTC](https://community.zeek.org/t/tuning-bro/4421/1 "2016-10-19T09:03:34Z")

</div>

Hi,

Recently I install bro ids instance on my network.

I want to filter out all internal dns messages from dns.log.

I need an explanation how i configure this and where.

Thanks,

CM.

---

<div class="post-metadata">

**Author:** ![MILLER\_BRAD\_L](https://avatars.discourse-cdn.com/v4/letter/m/e95f7d/32.png) [@MILLER\_BRAD\_L](https://community.zeek.org/u/MILLER_BRAD_L)\
**Post date:** [October 19, 2016, 1:11pm UTC](https://community.zeek.org/t/tuning-bro/4421/2 "2016-10-19T13:11:39Z")

</div>

I personally used a bro script much like example 3 in this link: [http://blog.bro.org/2012/02/filtering-logs-with-bro.html](http://blog.bro.org/2012/02/filtering-logs-with-bro.html)

You define what are “local” zones to and then splits the dns.log into dns\_localzone.log (your items) and dns\_remotezone.log (anything not defined). You can then process/query the remotezone log as you would with a dns.log and discard the localzone log if you wish. I would encourage you to keep that localzone log though, it’s a great resource.

Brad Miller

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/tuning-bro/4421/3 "2022-05-06T15:44:10Z")

</div>