4.2 Bro Scripts
Installing Bro automatically creates the following cron jobs,
which are run on at the specified intervals.
- site-report.pl: generates an email report of all alarms
and notifications
- mail_reports.sh: send email reports
These scripts can also all be run by hand at any time.
As Bro log files can get large quickly, it is important to ensure that
the Bro disk does not fill up. Bro includes some simple scripts to help
manage disk space. Most sites will want to customize these for their
own requirements, and integrate them into their backup system to make
sure files are not removed before they are archived.
- check_disk.sh: send email if disk space is too low
- bro_log_compress.sh: remove/compress old log files
These scripts can be customized by editing their settings in
$BROHOME/etc/bro.cfg
.
The settings are as follows:
- check_disk.sh:
- diskspace_pct: when disk is >= this percent full, send
email (default = 85%)
- diskspace_watcher: list of email addresses to send mail
to
- bro_log_compress.sh:
- Days2deletion: remove files more than this many days old
(default = 60)
- Days2compression: compress files more than this many
days
old (default = 30)