<div dir="ltr">How exactly are you reproducing that?<div><br></div><div>I tried this:</div><div><br></div><div>==> foo.sig <==<br>signature foo {<br> ip-proto == tcp<br> tcp-state established,originator<br> event "hello"<br> payload /.*hello/<br>}<br><br>==> foo.zeek <==<br>@load-sigs ./foo.sig<br>event zeek_init()<br> {<br> local f = Log::get_filter(Signatures::LOG, "default");<br> f$interv = 30 secs;<br> Log::add_filter(Signatures::LOG, f);<br> }<br></div><div><br></div><div>and just running zeek foo.zeek and after making 2 connections a minute apart ended up with 2 rotated log files.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 15, 2020 at 1:18 PM os <<a href="mailto:adamp@os.pl">adamp@os.pl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">hello members,<br>
<br>
Please, can you help me<br>
<br>
I have problem with log rotation for signature LOG (only)<br>
<br>
when I use scripts ,<br>
<br>
event zeek_init()<br>
{<br>
local f = Log::get_filter(Signatures::LOG, &quot;default&quot;);<br>
f$interv = 1 min;<br>
Log::add_filter(Signatures::LOG, f);<br>
}<br>
<br>
after run I have error.<br>
<br>
expression error in <br>
/usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line <br>
579: no such index (Log::all_streams[Log::id])<br>
fatal error: errors occurred while initializing<br>
<br>
The problem occurs in versions 3.0.1; 3.1.0-dev.376<br>
<br>
Thank you , hello Zeek Team,<br>
Please, can you help me<br>
<br>
I have problem with log rotation for signature LOG (only)<br>
when I use scripts ,<br>
event zeek_init()<br>
{<br>
local f = Log::get_filter(Signatures::LOG, "default");<br>
f$interv = 1 min;<br>
Log::add_filter(Signatures::LOG, f);<br>
}<br>
after run zeek a see error.<br>
expression error in <br>
/usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, line <br>
579: no such index (Log::all_streams[Log::id])<br>
fatal error: errors occurred while initializing<br>
<br>
The problem occurs in versions 3.0.1; 3.1.0-dev.376<br>
<br>
Thank you, for any help.<br>
<br>
Adam<br>
Adam<br>
<br>
<br>
<br>
<br>
- - - - - - - - - - - - - - - - - - - - <br>
<br>
H o s t i n g z d a r m o w y m c e r t y f i k a t e m S S L z a p o l o w e - k l a t k a . p l<br>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Justin</div></div>