[Bro] debugging script

Johanna Amann johanna at icir.org
Thu Aug 4 09:21:40 PDT 2016


> After changing the file contents, the new data doesn't seem to be making it
> into the table. I tried adding print statements into the 'event entry' but
> not sure where those prints are going. Where do the output of the print
> statements go on a running system (i.e. a cluster)? Is there a way for me
> add some debugging info into scripts i.e. printf like debugging? Any
> pointers are much appreciated... thanks.

When you are running with broctl, I think the print output goes into

So, e.g. [base]/spool/worker-1/stdout.log.

Generally, if something odd happens with the input framework, looking at
reporter.log also always is a good idea; if the input framework stops
reading from a specified stream, it always logs the errors there.

I hope this helps,

More information about the Bro mailing list