Investigating logger crash/restart events
Mustafa Qasim <[email protected]> Wed, 2 Oct 2019 19:04:43 +1000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAFhjsXJPD-2SUQGAvcj5y8Ff7BqxJ59muZZVPUW4GmL+o1Mb_w@mail.gmail.com> |
Hi, I have an instance where log files were terminated during the day and started the next day around the same time. broctl status shows that logger started exactly a few seconds before the time logging was resumed. What procedures one can follow to investigate such disruption? ------ *Mustafa Qasim* _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek