[Bro] Bro sending sporadic email

Robin Sommer robin at icir.org
Wed Aug 18 14:42:41 PDT 2010

On Wed, Aug 18, 2010 at 11:38 -0600, you wrote:

> Just last weekend, our Bro cluster started randomly skipping emailed
> reports. 

Sorry, no immediate idea.  Does this apply to both the alarm mail
and the traffic summaries? Are Bro's log files rotated and archived

There's no logging for the reporting, so it's hard to say what's
going on. You could add some debugging output to the
postprocessor/{mail-log,summarize-connections} scripts to see if
they get executed.


Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list