[Bro] Question on cutting down on number of conn.log entries

Azoff, Justin S jazoff at illinois.edu
Wed Mar 8 11:22:39 PST 2017

> On Mar 8, 2017, at 2:11 PM, Espresso Beanies <espressobeanies at gmail.com> wrote:
> Hi,
> I'm realizing my conn.log is eating up most of my performance and I'm trying to cut down the number of times Bro makes a duplicate entry in the conn.log file.

What do you mean by duplicate entries?  Are you seeing the same exact connection(same 5 tuple) logged multiple times?

- Justin Azoff

More information about the Bro mailing list