Gource, fed from bro conn.log in real-time.

gistfile1.txt

# See details in this blog entry:
# http://www.echothrust.com/blogs/monitoring-pf-logs-gource

ssh sensor01 "stdbuf -i0 -o0 -e0 tail -F -n +1 /var/opt/bro/logs/current/conn.log | stdbuf -i0 -o0 -e0 /opt/bro/bin/bro-cut -F\| ts id.orig_h id.resp_h id.resp_p proto" | stdbuf -i0 -o0 -e0 awk -F\| -vOFS=\| '{ gsub(/\..+/, "", $1); print $1, $2, "A", "/"$3"/"$2"/"$2":"$5"."$4,"#FF00ff"}' | ./gource --multi-sampling --no-vsync --title "bro conn activity" --key   --realtime --highlight-users --highlight-dirs --user-friction 0.2   --user-scale 0.8 --log-format custom --disable-auto-rotate -i 0 -