# Writing to SSL log

**URL:** <https://community.zeek.org/t/writing-to-ssl-log/5456>\
**Category:** Zeek\
**Created:** [September 13, 2018, 5:31pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456 "2018-09-13T17:31:35Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\
**Post date:** [September 13, 2018, 5:31pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/1 "2018-09-13T17:31:35Z")

</div>

I’ve extended the SSL log with 2 fields.

redef record SSL::Info += {  
foo: int &log &optional;  
bar: string &log &optional;  
};

I’m trying to set the values win the “connection\_state\_remove” event with the following.

event connection\_state\_remove(c: connection) {  
c$ssl$foo = 1;

c$ssl$bar = “TEST”;  
}

ssl.log shows the fields in the #fields line but the fields remain “-”. I’ve tried messing with the priority level but it’s not working. Something else going on here?

Thanks!

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [September 13, 2018, 5:50pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/2 "2018-09-13T17:50:04Z")

</div>

That works for most things, but the ssl log is primarily written to at the end of the ssl negotiation, not the end of the connection.

if you look in scripts/base/protocols/ssl/main.bro you see that the ssl log is written to by the log\_record / finish helper functions, which are called from:

ssl\_established, connection\_state\_remove(if not already logged!), and protocol\_violation so in your case, what could work is

event ssl\_established(c: connection) {  
&nbsp;&nbsp;c$ssl$foo = 1;  
&nbsp;&nbsp;c$ssl$bar = "TEST";  
}

However, The ssl script also has this feature:

&nbsp;&nbsp;&nbsp;&nbsp;# Hook that can be used to perform actions right before the log record  
&nbsp;&nbsp;&nbsp;&nbsp;# is written.  
&nbsp;&nbsp;&nbsp;&nbsp;global ssl\_finishing: hook(c: connection);

So to ensure you catch everything and run at the right time, this will work even better:

hook ssl\_finishing(c: connection) {  
&nbsp;&nbsp;c$ssl$foo = 1;  
&nbsp;&nbsp;c$ssl$bar = "TEST";  
}

---

<div class="post-metadata">

**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\
**Post date:** [September 13, 2018, 7:46pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/3 "2018-09-13T19:46:24Z")

</div>

Justin, thanks! I remember having to use a different before to log it. I loaded up ssl and the following script but it’s not firing off.

test.bro:

hook ssl\_finishing(c: connection) {  
print “SSL Finishing Event!”;  
}

Is there much of a delay for this to execute?

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [September 13, 2018, 7:52pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/4 "2018-09-13T19:52:33Z")

</div>

Oh, that's what I get for not testing on 2.5.x. That hook is new and will be in 2.6, for now you would need  
to use the event ssl\_established.

---

<div class="post-metadata">

**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\
**Post date:** [September 13, 2018, 7:59pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/5 "2018-09-13T19:59:25Z")

</div>

lol, alright. I’ll test it out in 2.6. Thanks.

---

<div class="post-metadata">

**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\
**Post date:** [September 13, 2018, 8:26pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/6 "2018-09-13T20:26:53Z")

</div>

I used the ssl\_established event and appears to be a bit of a race condition for what I’m doing. I’m pulling in some data from broker and deliver from broker is slower than network traffic…

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/writing-to-ssl-log/5456/7 "2022-05-06T15:46:03Z")

</div>