<div dir="ltr">Just a guess, but it could be related to this: <a href="https://github.com/bro/bro/blob/master/CHANGES#L1578">https://github.com/bro/bro/blob/master/CHANGES#L1578</a><div><br></div><div>ints changed to uint64s. As an example, you can see how the HTTP analyzer was modified here: <a href="https://github.com/bro/bro/commit/96bcc2d69d72c21f5f4eff0c88cd8d43613bee22#diff-978a30a2ac40a10fbf3c8b5500d3a9f3">https://github.com/bro/bro/commit/96bcc2d69d72c21f5f4eff0c88cd8d43613bee22#diff-978a30a2ac40a10fbf3c8b5500d3a9f3</a></div><div><br></div><div>The other big change was moving to plugins, but if you're seeing it added as a child analyzer, that doesn't sound like it'd be the issue.</div><div><br></div><div>Was this analyzer written in BinPAC, or in C++?</div><div><br></div><div> --Vlad</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 16, 2015 at 9:22 PM, James Swaro <span dir="ltr"><<a href="mailto:james.swaro@gmail.com" target="_blank">james.swaro@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I have a TCP analyzer that I wrote for my master thesis which I'm trying to update to the latest version of Bro. After rebasing to the trunk, I observed only a few collisions. I resolved the collisions and but something seems to have changed with how the logs are written. Are there changes in the logging framework between Bro 2.2 and the current master which could influence how events are generated? Could this be a change in how packets are delivered to TCP child/support/application analyzers?<br></div><div><br></div>I am only guessing at things as I haven't had much time to debug why the logs aren't being generated. From some quick debug, I can see that the analyzer is still being added to TCP as a child analyzer, so it seems related to either delivery or event generation. <br><br></div>I know this is little information to go on. I can provide more information as needed. <br clear="all"><span class="HOEnZb"><font color="#888888"><div><div><div><div><br>-- <br><div><div dir="ltr"><div><div>James Swaro<br></div><div>Internetworking Research Group<br></div><div>Ohio University<br></div><div><br></div><div><br></div></div></div></div>
</div></div></div></div></font></span></div>
<br>_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro.org">bro-dev@bro.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" rel="noreferrer" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
<br></blockquote></div><br></div>