[Bro] turn off host up/down emails

James Lay jlay at slave-tothe-box.net
Mon Jul 14 10:21:32 PDT 2014


On 2014-07-14 08:48, Seth Hall wrote:
> On Jul 14, 2014, at 10:13 AM, James Lay <jlay at slave-tothe-box.net> 
> wrote:
>
>> Seth, we really need an option to turn these off.
>
> Fortunately I don't think I'm the appropriate person to direct this
> request to anymore! :)
>
> There is currently work going on to heavily revamp broctl and I'm
> sure that Justin and Daniel will take your suggestion into account.
>
> Justin, Daniel, do you guys have any thoughts into how this behavior
> could be better handled or have you already begun to restructure this
> code?  I vaguely recall someone mentioning going through and
> documenting all of the cases where emails are sent from BroControl as
> an attempt to rethink the whole approach to be more user focused and
> modernized (with how people run broctl clusters these days).  Am I
> remembering that correctly?
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/

Ah that's great thanks for the info Seth.  I'm thinking just an option 
in broctl.conf:

AlertOnInterface  =  no

Type of thing.

James



More information about the Bro mailing list