bro ids not producing Notice.Log files in Ubuntu

Question

I have an issue related to the bro ids in Ubuntu , bro is not producing the notice.log file after adding scripts. kindly anyone help me to solve this. Click here t see the log files which created after adding rules but here is notice.log file missing

Answer 1

Bro will only create a log if there is an event that requires it. Simply loading scripts does not guarantee the notice.log will exist. If you want to test this to verify whether or not notice.log is, in fact, not being created when it should be, create a basic Bro script that generates a notice from event bro_init(). That should force the notice.log to be created.

For example:

 @load base/frameworks/notice
 export {
   redef enum Notice::Type += {
    Test_Notice,
 };

 event bro_init()
 {
   NOTICE([$note=Test_Notice, $msg=fmt("Testing the Notice Framework")]);
 }