[Bro] Signatures

Seth Hall seth at icir.org
Wed Feb 9 09:47:12 PST 2011

On Feb 9, 2011, at 11:05 AM, David Rodrigues wrote:

> I had to stop bro to get the results...

Ah, Bro buffers file writes so you have two options (one which you've already found).

* Quit Bro so that files are flushed and closed.
* Disable the buffering on the file you are interested in -- set_buf(sig_file, F);


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list