[Bro] Question about hourly reports sended by Bro-IDS

C. L. Martinez carlopmart at gmail.com
Tue Nov 13 07:33:08 PST 2012


On Tue, Nov 13, 2012 at 3:07 PM, Tyler T. Schoenke
<tyler.schoenke at colorado.edu> wrote:
> Short answer: For Alarm Summary, yes, for Connection Summary no.
> Alarm summary is modifiable if you download the git copy of Bro or wait
> for the Bro 2.2 release.  Connection Summary emails are tied to log
> rotation, and happen hourly.  If you don't have a lot of logs, you could
> switch to daily rotation to change the connection summary interval to daily.
>
> http://tracker.bro-ids.org/bro/ticket/824
>
> Tyler
>
> --

Many thanks Tyler ... I will try it ...



More information about the Bro mailing list