#579: Syslog logging writer ----------------------+------------------------ Reporter: seth | Owner: Type: Problem | Status: new Priority: High | Milestone: Bro2.1 Component: Bro | Version: git/master Resolution: | Keywords: ----------------------+------------------------ Changes (by seth): * priority: Normal => High Comment: Bumping priority because this could make integration with Martin Holste's ELSA project much easier. I need to talk to him more about how it should work to integrate best. I expect that the threaded logging framework should make the integration very easy though. -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/579#comment:1> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

#579: "Raw" logging writer ----------------------+------------------------ Reporter: seth | Owner: Type: Problem | Status: new Priority: High | Milestone: Bro2.2 Component: Bro | Version: git/master Resolution: | Keywords: ----------------------+------------------------ Description changed by seth: Old description: New description: This was formerly a ticket about creating syslog logging writer, but I think we found a better and more general approach in a "raw" writer. The raw writer would abandon the normal tab separated output from the Ascii writer and instead would be based on a templating format passed through the config filter field. There should also be options for sending the formatted data to files, sockets, and syslog. This writer would open several doors for us: * Direct integration from script-land with ELSA. * Functional replacement for PRADS in script-land with integration into Sguil. * Direct script-land integration with the metrics framework and Graphite. Here is a made up example of creating a metrics filter for sending data to Graphite: {{{ Log::add_filter(Metrics::LOG, [$name="graphite", $writer=Log::WRITER_RAW, $path="tcp://1.2.3.4:2003/", $config = table(["fmt"] = "{{metric}} {{value}} {{ts}}")]); }}} -- -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/579#comment:3> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker