[Bro-Dev] [JIRA] (BIT-1124) process command misplaces custom scripts

Daniel Thayer (JIRA) jira at bro-tracker.atlassian.net
Thu Jan 30 10:25:58 PST 2014


    [ https://bro-tracker.atlassian.net/browse/BIT-1124?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15308#comment-15308 ] 

Daniel Thayer commented on BIT-1124:
------------------------------------

If you run "broctl process" with a custom script, then you need
to specify "--" so that broctl knows where the Bro options end
and where the custom scripts begin.  So your example
should be:
broctl process trace.pcap -- test.bro

Doing so moves test.bro farther down towards the end
of the Bro command line.  

However, in this example we still get a different error,
because broctl adds its own script (process-trace.bro,
which contains a couple of redefs) at the very end of
the Bro command.  I will change the order so that the
process-trace.bro is before the custom scripts (which
solves the syntax error).


> process command misplaces custom scripts
> ----------------------------------------
>
>                 Key: BIT-1124
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1124
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: BroControl
>    Affects Versions: 2.2
>            Reporter: Robin Sommer
>
> {noformat}
> # cat test.bro
> @load base/utils/site
> print Site::local_nets;
> {noformat}
> {{broctl  process trace.pcap test.bro}} gives:
> {noformat}
> error in /usr/local/bro-2.2/share/bro/policy/misc/loaded-scripts.bro, line 4: syntax error, at or near “module"
> {noformat}
> I believe it's due to test.bro being placed in the middle of the command line that {{process}} builds. If I move it to the end, it works fine.



--
This message was sent by Atlassian JIRA
(v6.2-OD-07-028#6211)



More information about the bro-dev mailing list