[Bro] ignoring all weird?

Tim Rupp tarupp at fnal.gov
Wed Mar 31 06:53:03 PDT 2010


On 03/30/2010 01:02 PM, Justin Azoff wrote:
> On Tue, Mar 30, 2010 at 11:55:41AM -0500, Tim Rupp wrote:
>> Is there a convenient way that I can suppress all weird messages that
>> would otherwise bubble up to the weird log?
> 
> try something like this:
> 
> redef suppress_notice_actions += {
>     Weird::ContentGap,
>     Weird::AckAboveHole,
>     Weird::WeirdActivity,
> };
> 

I was hoping it'd be that easy, but now the weird messages (content gap,
ack above a hole, etc) are going to stdout as well as the weird log.

Ideas?

Thanks,
-Tim



More information about the Bro mailing list