[Bro-Dev] #579: "Raw" logging writer (was: Syslog logging writer)

Bro Tracker bro at tracker.bro-ids.org
Fri Nov 2 19:35:03 PDT 2012

#579: "Raw" logging writer
  Reporter:  seth     |      Owner:
      Type:  Problem  |     Status:  new
  Priority:  High     |  Milestone:  Bro2.2
 Component:  Bro      |    Version:  git/master
Resolution:           |   Keywords:
Description changed by seth:

Old description:

> Martin has completely convinced me of the need for this.  I don't know
> about timeline we should put on it though.  The one thought I have about
> it is that it needs to use TCP due to extremely long lines that Bro logs
> tend to have.  I think it would be ok for it to have the same output
> rendering that the LogAscii writer has.

New description:

 This was formerly a ticket about creating syslog logging writer, but I
 think we found a better and more general approach in a "raw" writer.  The
 raw writer would abandon the normal tab separated output from the Ascii
 writer and instead would be based on a templating format passed through
 the config filter field.  There should also be options for sending the
 formatted data to files, sockets, and syslog.

 This writer would open several doors for us:

   * Direct integration from script-land with ELSA.
   * Functional replacement for PRADS in script-land with integration into
   * Direct script-land integration with the metrics framework and

 Here is a made up example of creating a metrics filter for sending data to

 Log::add_filter(Metrics::LOG, [$name="graphite",
                                $config = table(["fmt"] = "{{metric}}
 {{value}} {{ts}}")]);


Ticket URL: <http://tracker.bro-ids.org/bro/ticket/579#comment:3>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list