Thanks all.<br><br>So the good news is that it seems to have found the referenced variables, but they are creating a type error in the notice_action_filters table:<br><br>notice.bro, line 6 and /usr/local/bro/policy/notice.bro, lines 74-75<br>
(enum and table[enum] of function(n:record { note:enum; msg:string; sub:string; conn:record { id:record { orig_h:addr; orig_p:port; resp_h:addr; resp_p:port; }; orig:record { size:count; state:count; }; resp:record { size:count; state:count; }; start_time:time; duration:interval; service:set[string]; addl:string; hot:count; history:string; }; iconn:record { orig_h:addr; resp_h:addr; itype:count; icode:count; len:count; }; id:record { orig_h:addr; orig_p:port; resp_h:addr; resp_p:port; }; src:addr; dst:addr; p:port; user:string; filename:string; method:string; URL:string; n:count; src_peer:record { id:count; host:addr; p:port; is_local:bool; descr:string; class:string; }; tag:string; dropped:bool; captured:string; }; a:enum;) : enum): error, type clash in table initializer<br>
<br>Thoughts? Does this enum need to be updated somewhere?<br><br>0100<br><br><div class="gmail_quote">On Mon, Dec 8, 2008 at 12:56 PM, Robin Sommer <span dir="ltr"><<a href="mailto:robin@icir.org">robin@icir.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"><br>
On Mon, Dec 08, 2008 at 12:09 -0800, 0100 wrote:<br>
<br>
<br>
> <a href="http://www.bro-ids.org/wiki/index.php/User_Manual:_Customizing_Bro" target="_blank">http://www.bro-ids.org/wiki/index.php/User_Manual:_Customizing_Bro</a>) on how<br>
<br>
</div>You're likely using a newer version than this was written for (as it<br>
seems you already guessed). The variables from weird.bro are now in<br>
a namespace Weird so you should write Weird::WeirdActivity etc. (and<br>
also @load weird).<br>
<br>
Robin<br>
<font color="#888888"><br>
--<br>
Robin Sommer * Phone +1 (510) 666-2886 * <a href="mailto:robin@icir.org">robin@icir.org</a><br>
ICSI/LBNL * Fax +1 (510) 666-2956 * <a href="http://www.icir.org" target="_blank">www.icir.org</a><br>
</font></blockquote></div><br>