Re: logger in a Zeek's cluster
Robin Sommer <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
On Fri, May 17, 2019 at 13:36 +0000, Palumbo Mauro wrote: > The logger too does receive only a few events from the other nodes > using the cluste/broker frameworks, but not those related to logging. > How does it get the logging data from the workers? Logging doesn't go through events, it's communicated separately over Broker through dedicated log messages. You can get statistics for that through the get_broker_state() function [1]. The returned BrokerStats record has fields num_logs_incoming and num_logs_outgoing. Robin [1] https://docs.zeek.org/en/latest/scripts/base/bif/stats.bif.zeek.html#id-get_broker_stats -- Robin Sommer * Corelight, Inc. * [email protected] * www.corelight.com _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek