Disable scripts in zeek

Zeek
1

I want to prevent all these alerts coming from the scripts one in particular is CaptureLoss::Too_Much_Loss from the capture_loss.
One thing I tried is commenting out the loading of the scripts in the local.zeek file but it doesnt seem to work.
Any ideas?
Thanks in advance!

2

The CaptureLoss::Too_Much_Loss notice is raised if more than a configured fraction of traffic could not be captured by Zeek. This could happen for a number of reasons, among them problems with the tapping, or an underprovisioned sensors. Capture loss means that Zeek has degraded visibility into the traffic so which will also e.g., degrade information in logs. You should try to fix the capture loss issue.

Zeek has a full framework for working with notices. What you want to do here is ignore a particular notice so it does not get logged anymore. A simple way to do that is to add the notices to ignore to Notice::ignored_types, e.g.,

# In `local.zeek`.
redef Notice::ignored_types += { CaptureLoss::Too_Much_Loss };

Another way to go about this would be to raise the threshold above which the notice gets raised (the default value is more than 10% loss).

# In `local.zeek`.

# Raise notice if more than 15% are lost.
redef CaptureLoss::too_much_loss = 0.15;
1 Like
3

I see now,thanks!
Is there a way to disable the notice framework as a whole?

4

Also I added the line

redef Notice::ignored_types += { CaptureLoss::Too_Much_Loss };

to local.zeek as you said and restarted zeek and alerts are still coming what could be wrong?
Its almost like zeek ignores my local.zeek file.