Notices that are deemed particularly important are called Alarms. Alarms are sent to the alarm log file, and to optionally to syslog.
The standard Bro distribution supports a number of types of notice actions, these are:
NOTICE_IGNORE
do nothing NOTICE_FILE
send to 'notice' file NOTICE_ALARM_ALWAYS
send to alarm file and syslog NOTICE_ALARM_PER_CONN
send to alarm file once per connection NOTICE_ALARM_PER_ORIG
not used, so remove? maybe in priv stuff? NOTICE_ALARM_ONCE
not used, so remove? maybe in priv stuff? NOTICE_ALARM_EMAIL
send to alarm file and send email
It is also possible to define your own custom notice actions.
By default, all notices are set to NOTICE_ALARM_ALWAYS except for the following:
ContentGap, AckAboveHole, AddressDropIgnored, PacketsDropped, RetransmissionInconsistency
To also send all Alarms to syslog, set this in BROHOME/local.site.bro
:
redef syslog_alarms = T;
To change the default notice action for a given notice, add something like this to your site/local.site.bro
file:
redef notice_action_filters += { [[WeirdActivity, ContentGap]] = ignore_notice, };
This will cause the Notices WeirdActivity
and ContentGap
to no longer get logged anywhere.
To send these Notices to the Notice log file only, and not to the Alarm log, add this:
redef notice_action_filters += { [[WeirdActivity, ContentGap]] = file_notice, };