Re: Decreasing Log Cycle Time
Peter Hallin <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hello Michael, In your broctl.cfg file, you can set the rotation interval to 300 seconds with: LogRotationInterval = 300 Also, if you want to disable gzip on rotation, use this: CompressLogs = 0 Brgds, Peter On 2019-09-04 11:03, Michael Gez wrote: > Hi all, > > If I am not mistaken, Bro/Zeek cycles logs hourly. > This cycle is causing some unpredictable behavior in my tailing algorithm. > > If i could set it to cycle every 5 minutes rather than on the hour, it > would be very beneficial to testing and resolving issues. > Is there a way I can reduce the amount of time Bro takes in between log > cycles? > > Thanks! > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek