> # bro -r trace.1 ./mypolicy.bro | dbi-bro.pl > > But when I use live traffic, I can't pipe or redirect the log output to > the script, even a file. I don't know why. :( Could it simply be due to buffering? Bro's stdout is block-buffered unless you add a call to flush_all() in your policy script. Vern