# Write logs from worker node directly

**URL:** <https://community.zeek.org/t/write-logs-from-worker-node-directly/5693>\
**Category:** Zeek\
**Created:** [May 7, 2019, 7:36pm UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693 "2019-05-07T19:36:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Woot4moo](https://avatars.discourse-cdn.com/v4/letter/w/e0b2c6/32.png) [@Woot4moo](https://community.zeek.org/u/Woot4moo)\
**Post date:** [May 7, 2019, 7:36pm UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693/1 "2019-05-07T19:36:55Z")

</div>

Is it possible to write logs directly from the worker node instead of making a call out to a logging node?

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [May 8, 2019, 2:12pm UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693/2 "2019-05-08T14:12:16Z")

</div>

I believe

redef Log::enable\_remote\_logging = F;

will do that. Not sure if rotation works by default so you might have  
a little more work to do if you are logging to files. If you're using  
something like the Kafka log writer then it should just work

---

<div class="post-metadata">

**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\
**Post date:** [May 8, 2019, 3:19pm UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693/3 "2019-05-08T15:19:08Z")

</div>

I am curious, why do you want to do this. What would be your use-case ?

Aashish

---

<div class="post-metadata">

**Author:** ![Woot4moo](https://avatars.discourse-cdn.com/v4/letter/w/e0b2c6/32.png) [@Woot4moo](https://community.zeek.org/u/Woot4moo)\
**Post date:** [May 9, 2019, 12:35am UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693/4 "2019-05-09T00:35:50Z")

</div>

Appreciated will investigate

---

<div class="post-metadata">

**Author:** ![Woot4moo](https://avatars.discourse-cdn.com/v4/letter/w/e0b2c6/32.png) [@Woot4moo](https://community.zeek.org/u/Woot4moo)\
**Post date:** [May 9, 2019, 12:36am UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693/5 "2019-05-09T00:36:52Z")

</div>

Exploring different tuning options. Specifically, is there any benefit / detriment to writing logs locally thereby removing the additional call to another node.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/write-logs-from-worker-node-directly/5693/6 "2022-05-06T15:46:29Z")

</div>