diff --git a/osect_sensor/Infrastructure/edge_cron/work/ot_tools/bro.sh b/osect_sensor/Infrastructure/edge_cron/work/ot_tools/bro.sh index 7019791..a225810 100755 --- a/osect_sensor/Infrastructure/edge_cron/work/ot_tools/bro.sh +++ b/osect_sensor/Infrastructure/edge_cron/work/ot_tools/bro.sh @@ -13,6 +13,9 @@ reformat_log () { } cd $1/$2 +# conn_long.logと重複するためconn.logに出力されるduration>60を除外 +awk '$9<60{print}' $(find /opt/zeek/logs -name "conn.*.log") > "/opt/zeek/logs/conn_replace.log" +rm $(find /opt/zeek/logs -name "conn.*.log") # conn.logとconn_long.logの両方を回収 merge_log "conn*.log" "conn.log" merge_log "arp.*.log" "arp.log"