4.2 Bro Scripts
Installing Bro automatically creates the following cron jobs,
which are
automatically run on a specified interval.
- site-report.pl: generates an email report of all alarms
and alerts
- mail_reports.sh: send email reports
These scripts can also all be run by hand at any time.
Bro log files can get quick large, and it is important to make sure that
the Bro disk
does not fill up. Bro includes some simple scripts to help manage disk
space. Most
sites will want to customize these for their own requirements, and
integrate them into their
backup system to make sure files are not removed before they are
archived.
- check_disk.sh: check for low disk space, and send email
- bro_log_compress.sh: removes/compresses old log files
These scripts can be customized by editing their settings in
$BROHOME/etc/bro.cfg
.
The settings are as follows:
- check_disk.sh:
- diskspace_pct: when disk is >= this percent full, send
email
- diskspace_watcher: list of email addresses to send mail
to
- bro_log_compress.sh:
- Days2deletion: remove files more than this many days old
(default = 60)
- Days2compression: compress files more than this many days
old (default = 30)