Hi, When I run : bro -i eth0 -i eth1 /usr/local/bro/share/bro/base/protocols/dns/main.bro listening on eth0, capture length 8192 bytes listening on eth1, capture length 8192 bytes 1413981834.692222 warning in /usr/local/bro/share/bro/base/misc/find-checksum-offloading.bro, line 54: Your interfa…

It looks like you have bad checksums probably from NIC checksum offloading. :slight_smile: .Seth

I have bro on Ubuntu 14.04 VM’s running under VirtualBox on Linux . Should the dns.logs appear /usr/local/bro/logs if those errors were corrected ? The logs appear when I start bro using broctl .

I get the sense you've made changes to broctl's configuration then. Did you add broars=-C to broctl.cfg perhaps? .Seth

No changes made to broctl.cfg ! I am running bro outside of broctl … are those setting read by bro during startup ?

I'm confused. You first said that you weren't getting logs when you ran Bro outside of BroControl but then you said you were getting logs when you ran Bro with BroControl. If you run bro directly at the command line, it won't load any of the broctl scripts or implement any of the broctl configurat…

Bingo - the dns.log is in the cwd ! Q answered !

Try running bro -C -i eth0 -i eth1 By default, all scripts in base/ are loaded when calling Bro. Log files are dropped in your working directory when running bro without broctl. Just a note, don’t ever change scripts in base/. -AK

Where are the log files when DNS monitoring ran by cli ?

Zeek

Topic		Replies	Views
No http.log and dns.log Zeek	1	138	May 6, 2022
DNS query logging Zeek	4	154	May 6, 2022
No log when bro script is run with broctl Zeek	3	99	May 6, 2022
http.log and dns.log missing Zeek	1	130	May 6, 2022
Hui Lin_Any thing logged in /usr/local/bro/logs Development development	2	84	May 6, 2022

Where are the log files when DNS monitoring ran by cli ?

Related topics