[Bro] Some events not received by broccoli

Björn Samvik Bjorn.Samvik at netclean.com
Fri Nov 22 07:04:53 PST 2013


I'm using broccoli to receive bro (2.2-5) events and are having some problems. Consider the following.

The broccoli client is listening to 2 events.
bro_event_registry_add(m_bc, "file_new", (BroEventFunc)&Broccoli::newFile, this);
bro_event_registry_add(m_bc, "test_event", (BroEventFunc)&Broccoli::newFile, this);

The following bro script is used.

global test_event: event(f: fa_file);
event file_new(f: fa_file)
    event test_event(f);

The file_new event is correctly received by my broccoli client however the test_event is not received. If I change the content of the test_event to something else it works.

global test_event: event(f: string);
event file_new(f: fa_file)
    event test_event(f$mime_type);

So, is this expected and in that case why and what is the proposed way of solving the issue?

(Also noticed that the file_state_removed(f: fa_file) event is not received by the broccoli client.)

Thank you

Björn Samvik
Software Developer


NetClean Technologies Sweden AB
Första Långgatan 30 – SE-413 27 Göteborg – Sweden

Phone: +46 31 719 08 00 – Fax: +46 31 13 89 50
Direct: +46 31 719 08 22 – Mobile: +46 709 36 83 03

Bjorn.Samvik at netclean.com
<mailto:Bjorn.Samvik at netclean.com>www.netclean.com<http://www.netclean.com>

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131122/e7c0d256/attachment.html 

More information about the Bro mailing list