<div dir="ltr"><span style="font-size:12.8px">Hello,</span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I am trying to setup Bro to log all the events to a SQLite database. In my local.bro file, I have added an event bro_init() with filters specifying the writer to be WRITER_SQLITE like this:</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>       local filter_conn: Log::Filter =</div><div>                [</div><div>                $name=&quot;sqlite&quot;,</div><div>                $path=&quot;/var/db/conn&quot;,<br></div><div>                $config=table([&quot;tablename&quot;] = &quot;conn&quot;),</div><div>                $writer=Log::WRITER_SQLITE</div><div>                ];</div><div><br></div><div>        Log::add_filter(Conn::LOG, filter_conn);</div><div><br></div><div>        local filter_notice: Log::Filter =</div><div>                [</div><div>                $name=&quot;sqlite&quot;,</div><div>                $path=&quot;/var/db/conn&quot;,</div><div>                $config=table([&quot;tablename&quot;] = &quot;notice&quot;),</div><div>                $writer=Log::WRITER_SQLITE</div><div>                ];</div><div><br></div><div>        Log::add_filter(Notice::LOG, filter_notice);</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">... + other filters for http, dhcp and weird set accordingly.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I want the logs to be written to separate tables in one SQLite database. However, when I run bro with this configuration, I almost immediately get SQLite errors:</div><div style="font-size:12.8px"><div>error: /root/bakalarka/capture/bro/sql/log/Log::WRITER_SQLITE: SQLite call failed: database is locked</div><div>error: /root/bakalarka/capture/bro/sql/log/Log::WRITER_SQLITE: terminating thread</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">After that, nothing else is written to affected table. Please can You suggest me what should I do to achieve logging to one database with multiple tables?</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Thanks</div><div><div class="gmail_signature"><div dir="ltr"><br></div></div></div>
</div>