[Bro] Buffered output on logs

Eric Wages ewages at colsa.com
Fri Dec 22 13:03:39 PST 2006


Question for you folks - clearly the logging functionality of Bro is  
buffered, but will it also be flushed after a certain time has  
expired as well?

I'm noticing that the alarm output file can have immediate writes,  
but something like the ssh output file will have 0 bytes until I  
manually checkpoint the server.

Your thoughts?

Thanks,

-Eric

Eric Wages
COLSA Corporation
Operations Manager, HMT ROC
256-721-0372, ext 110






More information about the Bro mailing list