Installing brolite automatically creates the
following These scripts can also all be run by hand at any time. Be sure your
$BROHOME environment variable is set first.
As Bro log files can get large quickly, it is important to ensure that
the Bro disk does not fill up. Bro includes some simple scripts to help
manage disk space. Most sites will want to customize these for their
own requirements, and integrate them into their backup system to make
sure files are not removed before they are archived.
These scripts can be customized by editing their settings in
cron
jobs,
which are run on at the specified intervals.
site-report.pl
: generates a text report of all alarms
and notifications
mail_reports.sh
:emails the reports generated
by site-report.pl
to the list of addresses specified in the file $BROHOME/etc/bro.cfg
check_disk.sh
: send email if disk space is too low
bro_log_compress.sh
: remove/compress old log files
$BROHOME/etc/bro.cfg
.
The settings are as follows:
check_disk.sh
:
diskspace_pct
: when disk is >= this percent full, send
email (default = 85%)
diskspace_watcher
: list of email addresses to send mail
to
bro_log_compress.sh
:
Days2deletion
: remove files more than this many days old
(default = 60)
Days2compression
: compress files more than this many
days
old (default = 30)