[Bro] Printing a header when a file is opened/rotated

[Justin Azoff]

Prior to using broctl I was using a setup like this:

const phish_log = open_log_file("phish") &raw_output;

event bro_init()
{
    print phish_log, cat_sep("\t", "\\N", "start", "orig_h", "mailfrom", "replyto", "subject");
}

Now that I'm using broctl, it rotates the logs once a day to their new locations.  My problem is that
when the file is rotated nothing re-adds the header.

I'm not sure what the best way to fix this is.  I know I could disable the
rotate interval and go back to restarting bro everyday at midnight.  Could
something like this work?

event rotate_interval(f: file) &priority=10
{
    if (f$name == "phish.log"){
        print f, cat_sep("\t", "\\N", "start", "orig_h", "mailfrom", "replyto", "subject");
    }
}

I'm thinking that if there was a file_opened event then that could be used
to handle both cases.

-- 
-- Justin Azoff
-- Network Performance Analyst