[Bro] Schedule an event

Johanna Amann johanna at icir.org
Mon Nov 28 15:08:06 PST 2016

Hello Troy,

yes, you can indeed use schedule for that. Just create an event that does
the searching, schedule it once and then re-schedule it inside the event.

So something along the lines of:

event search()
	# do the searching

	schedule 30min { search() };

event bro_init()
	schedule 30min { search() };


On Tue, Nov 08, 2016 at 03:13:29PM -0500, Troy Ward wrote:
> I have a script based on the conn.log events.  As connections are created
> it populates some information in a table.  I need to trigger a search of
> that table to occur every 30 minutes.  I believe I can use the "schedule"
> command but not entirely sure.  So my question is, can I build a function
> within my script that does the table search and if so, how do I use the
> schedule command to trigger the function?
> Thanks in advance,
> Troy W

> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

More information about the Bro mailing list