[Bro] Re-reading data in the input framework

Sheharbano Khattak sheharbano.k at gmail.com
Thu Jun 28 23:47:50 PDT 2012


I want to test if a table that holds data from an input source file with
the automatic refresh mode "REREAD" reflects changes applied to the source
file. This is what my file looks like

module Config;

type Idx: record {
        parameter: string;

type Val: record {
        value: string;

export {
    global table_config: table[string] of Val;

global config_filename = "/usr/local/bro/share/bro/site/botflex/config.txt";

event bro_init() &priority=20
    Input::add_table([$source=config_filename, $name="config_stream",
              $val=Val, $destination=table_config, $mode=Input::REREAD]);

event Input::update_finished(name: string, source: string)
    # now all data is in the table
    print "Updated";
    print table_config;

event bro_done()
    print "Ending";
    print table_config;

I do bro -i eth0 config.bro. The first time, the event
Input::update_finished is triggered with the values/indices defined in
Then i manually make some changes in config.txt and save the changes but
Input::update_finished is not triggered. After waiting for several minutes,
i ctrl+c Bro hoping to see the modification in table_config, still it shows
the old values. There is nothing interesting in reporter.log either. What
am i doing wrong?

Sheharbano Khattak

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20120629/7f9cf7a7/attachment.html 

More information about the Bro mailing list