[Bro] Log rotation and /dev/null with broctl

Seth Hall seth at icir.org
Mon Oct 18 12:26:23 PDT 2010


On Oct 18, 2010, at 3:12 PM, Robin Sommer wrote:

> On Mon, Oct 18, 2010 at 11:40 -0700, Matthias Vallentin wrote:
> 
>> to get rid of the error. Thanks for the hint.
> 
> We should check for that. Can you file a ticket to remember it?

It would be good to have some good clarification on how *not* to print to log files.  I've been doing the close() trick in my logging framework for a long time but you and Vern both agreed that using close() probably isn't the right way to do it.  It works really well in this situation though because it does prevent remote printing as well as local printing.

  .Seth



More information about the Bro mailing list