[Bro] How to dissable http_log

Vern Paxson vern at icir.org
Tue Dec 12 17:47:48 PST 2006


> I would like to redefine/disable http_log and "ignore" normal logging 
> due to heavy  http traffic on my net but I'm still interested in alerts 
> triggered by HTTP_SensitiveURI.

Is your concern the CPU time (which likely won't go down much if you turn
off logging), or the disk space?  You can turn off the logging (the file
will be empty) using:

	module HTTP;
	event bro_init()
		{
		close(http_log);
		}

- Vern



More information about the Bro mailing list