> /tmp/bro/bro/policy/pcap.bro, line 62: error: unknown identifier log, at > or near "log" What version of Bro are you using? 0.9 has changed "log" to "alarm". In addition, pcap.bro that ships with the latest 0.9 doesn't have a line like the one you show. Vern