[Bro] How to modify http.log

Vito Logrillo vitologrillo at gmail.com
Wed May 27 03:03:15 PDT 2015

Hi all,
i'm trying to modify http.log using the script written below

redef record HTTP::Info += {
        host_ip: set[addr] &optional &log;

event connection_state_remove(c: connection) &priority=5
        local record_flag: bool = F;

        if  (/^[hH][tT][tT][pP]:/ in c$http$uri)

                record_flag = T;

                when (local h = lookup_hostname(c$http$host))
                        record_flag = F;
                        if (|h|>0 && ( !in h))
                                c$http$host_ip = h;
                                Log::write(HTTP::LOG, c$http);
        if (record_flag == T)

-----end script.bro----

I've added a new field in http.log (host_ip) in order to see the host
ip using the function lookup_hostname.
The script works well, but the same record is written twice (with and
without the host_ip field).
I've tried to use a state flag (record_flag) to avoid this, but the
result is the same.
How can avoid record duplicantion?

More information about the Bro mailing list