[Bro] SQLite logging and as white/blacklist in a cluster
Azoff, Justin S
jazoff at illinois.edu
Wed Oct 26 13:10:55 PDT 2016
> On Oct 26, 2016, at 3:41 PM, Papulis, George <george.papulis at wustl.edu> wrote:
> I have a bro script that logs events based on a blacklist, but I don't want to log the same IP - blacklisted item twice. I was thinking I could log the data using the SQLite writer, and then also read from that database checking if the event has been logged earlier. Has anyone used the SQLite logging in a cluster, and if so, is there anything I should look out for? The size of the log is very small.
> Will I need to manually sync the database so each node in the cluster can reference the tables?
A different approach here is probably better.
What is your timeframe for not logging something twice? Forever? or would once a day be ok?
- Justin Azoff
More information about the Bro