[Bro] Log rotation and /dev/null with broctl

[Justin Azoff]

On Mon, Oct 18, 2010 at 02:05:09PM -0400, Matthias Vallentin wrote:
> I receive some unexplainable errors using broctl:
> 
> 19 Oct 04:42:55 [output] /usr/local/share/broctl/scripts/archive-log: line 49: /home2/bro-logs/2010-10-16//dev/null.07:52:18-00:00:00.gz: No such file or directory

Do you have open_log_file("/dev/null") somewhere in one of your policy
scripts?  I don't think that sort of thing works, instead you need to
immediately close a file after opening it...

-- 
-- Justin Azoff
-- Network Security & Performance Analyst