Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

More adjustment to reduce Weird volumes.

Browse source 
- New script extracted from weird.bro to implement the
  connection related "weird" data into an optionally
  loaded script.

- Adjusted the default notice tuning to stop ignoring
  the connection related weirds since they aren't loaded
  by default anymore.
This commit is contained in:
Seth Hall 2011-10-04 13:58:55 -04:00
parent 04a9a0dc38
commit 5a04190ffe
3 changed files with 61 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/policy/tuning/defaults/remove-high-volume-notices.bro
View file

@ -4,11 +4,7 @@
@load base/frameworks/notice
@load base/frameworks/notice/weird
# Remove these notices from logging since they can be too noisy.
redef Notice::ignored_types += {
Weird::Content_Gap,
Weird::Ack_Above_Hole,
Weird::Retransmission_Inconsistency,
## Only allow these to go in the weird log.
Weird::Weird_Activity,
};