Package: base/frameworks/logging

The logging framework provides a flexible key-value based logging interface.

base/frameworks/logging/__load__.bro

base/frameworks/logging/main.bro

The Bro logging interface.

See Logging Framework for an introduction to Bro’s logging framework.

base/frameworks/logging/postprocessors/__load__.bro

base/frameworks/logging/postprocessors/scp.bro

This script defines a postprocessing function that can be applied to a logging filter in order to automatically SCP (secure copy) a log stream (or a subset of it) to a remote host at configurable rotation time intervals. Generally, to use this functionality you must handle the bro_init event and do the following in your handler:

  1. Create a new Log::Filter record that defines a name/path, rotation interval, and set the postprocessor to Log::scp_postprocessor.
  2. Add the filter to a logging stream using Log::add_filter.
  3. Add a table entry to Log::scp_destinations for the filter’s writer/path pair which defines a set of Log::SCPDestination records.

base/frameworks/logging/postprocessors/sftp.bro

This script defines a postprocessing function that can be applied to a logging filter in order to automatically SFTP a log stream (or a subset of it) to a remote host at configurable rotation time intervals. Generally, to use this functionality you must handle the bro_init event and do the following in your handler:

  1. Create a new Log::Filter record that defines a name/path, rotation interval, and set the postprocessor to Log::sftp_postprocessor.
  2. Add the filter to a logging stream using Log::add_filter.
  3. Add a table entry to Log::sftp_destinations for the filter’s writer/path pair which defines a set of Log::SFTPDestination records.

base/frameworks/logging/writers/ascii.bro

Interface for the ASCII log writer. Redefinable options are available to tweak the output format of ASCII logs.

The ASCII writer supports currently one writer-specific filter option via config: setting tsv to the string T turns the output into “tab-separated-value” mode where only a single header row with the column names is printed out as meta information, with no “# fields” prepended; no other meta data gets included in that mode.

Example filter using this:

local my_filter: Log::Filter = [$name = "my-filter", $writer = Log::WRITER_ASCII, $config = table(["tsv"] = "T")];

base/frameworks/logging/writers/dataseries.bro

Interface for the DataSeries log writer.

base/frameworks/logging/writers/sqlite.bro

Interface for the SQLite log writer. Redefinable options are available to tweak the output format of the SQLite reader.

See Logging To and Reading From SQLite Databases for an introduction on how to use the SQLite log writer.

The SQL writer currently supports one writer-specific filter option via config: setting tablename sets the name of the table that is used or created in the SQLite database. An example for this is given in the introduction mentioned above.

base/frameworks/logging/writers/elasticsearch.bro

Log writer for sending logs to an ElasticSearch server.

Note: This module is in testing and is not yet considered stable!

There is one known memory issue. If your elasticsearch server is running slowly and taking too long to return from bulk insert requests, the message queue to the writer thread will continue growing larger and larger giving the appearance of a memory leak.

base/frameworks/logging/writers/none.bro

Interface for the None log writer. This writer is mainly for debugging.

Copyright 2013, The Bro Project. Last updated on June 15, 2015. Created using Sphinx 1.2.2.