<div dir="ltr">We noticed that one of our hosts was causing this error to be thrown <br><br><div><div>1360776820.430495 Reporter::ERROR non-optional field "ts" missing in initialization ([note=Signatures::Multiple_Sig_Responders,
src_addr=<REDACTED>, sig_id=<REDACTED>,
event_msg=<REDACTED>, host_count=5, sub_msg=<REDACTED> has
triggered signature <REDACTED> on 5 hosts]) <no
location><br><br></div><div>I looked into it, and it looks to me like Multiple_Sig_Responders is in fact missing that field.<br></div>
</div><br><div>--- a/scripts/base/frameworks/signatures/main.bro</div><div>+++ b/scripts/base/frameworks/signatures/main.bro</div><div>@@ -270,7 +270,7 @@</div>
<div> orig, sig_id, hcount);</div><div><br></div><div> Log::write(Signatures::LOG,</div><div>- [$note=Multiple_Sig_Responders,</div><div>+ [$ts=network_time(), $note=Multiple_Sig_Responders,</div>
<div> $src_addr=orig, $sig_id=sig_id, $event_msg=msg,</div><div> $host_count=hcount, $sub_msg=horz_scan_msg]);</div><br><br clear="all"><div><div>--<br>AndrewB<br>Knowing is Half the Battle.<br>
</div>
</div></div>