[Bro] bro operational questions

[Dalton Porter]

Hi,
I need to keep bro up and running to process logs continuously.  I was wondering what folks would suggest for doing that.  Does broctl automatically restart the process if it dies?
 
Using broctl, how do I specify snaplen=X  in the config file? I have tried putting variations of this into broctl.cfg, but it's not happy
  BroArgs = snaplen 65535
.
 
Finally, what is the best way to specify the logging output path?  Is this in a config file or do I need to set it in a script?
   Log::add_filter(HTTP::LOG,[$name="myname", $path="/my/custom/path/basename", ...
Ideally, I would like to set the path on ALL logs with one setting, not just http.
 
Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20120507/117bcf97/attachment.html