[Bro] Still outstanding, scheduled events when Bro terminates

Christoph Goeldi goeldich at ee.ethz.ch
Fri May 20 01:30:14 PDT 2005


Hi

I write regularly (5min interval) some information to a file
which I use externally in a webpage by parsing the content.
I want to overwrite the old file everytime and don't like to
use log rotation because of disk space consumption.

I use the following code:

******** log.bro **********
# writes a summary of the currently seen hosts
# and its states to the file "current_states.log"
# do this regularly all Xmins (log_interval)
event print_current_states_file() {
         # opens the file "current_states.log"
         local current_states_file = open("current_states.log");

         # write file header
         print "...";
	...

         # close the file "current_states.log"
         close(current_states_file);

         # do it again in Xmins
         schedule log_interval {print_current_states_file()};
}

event bro_init() {
         # start log
         schedule log_interval {print_current_states_file()};
}
***************************

Now my Problem:
When I terminate Bro it writes the scheduled print_current_states_file 
event a last time. Unfortunately, the data that i write to the file is
already incomplete because Bro already started to delete these tables.
Therefore, the file which remains after the termination of Bro is
unusable.

Any ideas, how to solve this problem?

Cheers
Christoph




More information about the Bro mailing list