about event handle

Vern Paxson vern at icir.org
Fri Sep 6 09:19:05 PDT 2002


> The access time on the modified bro.init before running bro is the same to 
> the time after running  bro. What shoul I do to make the bro read the 
> bro.init?

Bro searches $BROPATH, which defaults to

	.:policy:policy/local:/usr/local/lib/bro

so for bro.init it will load the first instance it finds along that path.
You should be able to use ls -ut to find just what files it's loading
along the path.

		Vern



More information about the Bro mailing list