[Bro] Take action on a notice?

Jesse Bowling jessebowling at gmail.com
Tue Apr 16 06:37:06 PDT 2013


I'm regularly seeing PacketFilter::Dropped_Packets notices in my logs,
which I believe are related to an issue with the version of PF_RING that
I'm using. I'm in the midst of getting it upgraded, but in the meantime I'd
love to be able to take an automated action on these notices (i.e.,
automatically restart the worker process that's dropping packets).

I know all the parts for doing this are in the archives somewhere, but
would someone mind giving me at least the high-level steps? My brogramming
is nascent at best...

Cheers,

Jesse

-- 
Jesse Bowling
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130416/ba854e32/attachment.html 


More information about the Bro mailing list