[Bro] Writing to SSL log

Neslog neslog at gmail.com
Thu Sep 13 10:31:35 PDT 2018


I've extended the SSL log with 2 fields.

redef record SSL::Info += {
    foo: int &log &optional;
    bar: string &log &optional;
};


I'm trying to set the values win the "connection_state_remove" event with
the following.

event connection_state_remove(c: connection) {
  c$ssl$foo = 1;
  c$ssl$bar = "TEST";
}

ssl.log shows the fields in the #fields line but the fields remain "-".
I've tried messing with the priority level but it's not working.  Something
else going on here?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180913/335bfb24/attachment-0001.html 


More information about the Bro mailing list