Latest news, tutorials, and insights from the logging category.
Zeek’s JSON logs can get large quickly, especially if you’re ingesting them into a SIEM that charges by data volume. There are two ways to address this: filtering out uninteresting log lines, and renaming fields to…
read more about Reducing Zeek JSON Log Size: Field Name Mapping and Log Filtering HooksZeek can write the same log stream in multiple formats simultaneously. If you need JSON for your SIEM and TSV for long-term archives, you’re in luck: a few lines of code handles both. There are several…
read more about How to Write Zeek Logs in JSON & TSV SimultaneouslyAt ESnet, our Zeek deployment was logging 4.2 million weirds per day. When we investigated, 90% were DNS-related and 98% of those came from a single opcode. After submitting a PR to fix it, daily weirds…
read more about Revisiting Weird-ness: Investigating DNS NOTIFY at ScaleBro’s default ASCII log format is not exactly the most efficient way for storing and searching large volumes of data. An an alternative, Bro 2.1 will come with experimental support for DataSeries output, an efficient binary…
read more about Upcoming: Binary Output with DataSeries