Node: Notice Actions, Next: , Previous: Notices, Up: Customizing Bro



Notice Actions

Notices that are deemed particularly important are called Alarms. Alarms are sent to the alarm log file, and to optionally to syslog.

The standard Bro distribution supports a number of types of notice actions, these are:

NOTICE_IGNORE do nothing
NOTICE_FILE send to 'notice' file
NOTICE_ALARM_ALWAYS send to alarm file and syslog
NOTICE_ALARM_PER_CONN send to alarm file once per connection
NOTICE_ALARM_PER_ORIG not used, so remove? maybe in priv stuff?
NOTICE_ALARM_ONCE not used, so remove? maybe in priv stuff?
NOTICE_ALARM_EMAIL send to alarm file and send email

It is also possible to define your own custom notice actions.

By default, all notices are set to NOTICE_ALARM_ALWAYS except for the following:

     ContentGap, AckAboveHole, AddressDropIgnored, PacketsDropped,
     RetransmissionInconsistency
     

To also send all Alarms to syslog, set this in BROHOME/local.site.bro:

   redef syslog_alarms = T;

To change the default notice action for a given notice, add something like this to your site/local.site.bro file:

   redef notice_action_filters += {
        [[WeirdActivity, ContentGap]] = ignore_notice,
   };

This will cause the Notices WeirdActivity and ContentGap to no longer get logged anywhere. To send these Notices to the Notice log file only, and not to the Alarm log, add this:

   redef notice_action_filters += {
        [[WeirdActivity, ContentGap]] = file_notice,
   };