[Bro] Disable broctl port-terminate script

David Hoelzer dhoelzer at enclaveforensics.com
Thu Mar 23 13:59:25 PDT 2017


Just modify the python source code; comment it out.

> On Mar 23, 2017, at 4:56 PM, Jack Covington <jackhcovington at gmail.com> wrote:
> 
> Hello, 
> 
> Is there was a way to disable the bro/share/broctl/scripts/post-terminate script that is called on "broctl stop" from control.py? 
> 
> I have a program that ingests a couple bro logs in spool/logger so I want to keep everything in that directory, but the post-terminate script moves them out to spool/tmp/post-terminate* directories. So far I just added an exit at the beginning of the script since I am not concerned with any archiving, but is there a more correct way to do it without modifying the bro script, maybe some option I can redefine in my local.bro?
> 
> I already set LogRotationInterval to 0 in broctl.config.
> 
> Thank you,
> Jack
> _______________________________________________
> 
> Bro mailing list
> 
> bro at bro-ids.org
> 
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro





More information about the Bro mailing list