[Bro-Dev] [JIRA] (BIT-1475) Exec::Run does not complete

Aaron (JIRA) jira at bro-tracker.atlassian.net
Tue Sep 8 15:16:00 PDT 2015


Aaron created BIT-1475:
--------------------------

             Summary: Exec::Run does not complete
                 Key: BIT-1475
                 URL: https://bro-tracker.atlassian.net/browse/BIT-1475
             Project: Bro Issue Tracker
          Issue Type: Problem
          Components: Bro
    Affects Versions: 2.3
         Environment: Centos 6.6
            Reporter: Aaron


I'm having trouble running an external  program in the callback function for an event when processing a pcap file.  It seems to work in bro_init, however, which confuses me. 

The working file will print out the output of the "ls" command, whereas the not-working file will not print out anything no matter how long I wait.

Specifically here I want to use the event when bro detects a file in the pcap.

working.bro (ran as simply "bro working.bro"):
{code:java}

@load base/utils/exec

redef exit_only_after_terminate=T;
event bro_init()
{
        local t= "ls /";
        local cmd = Exec::Command($cmd=t);
        when (local res = Exec::run(cmd))
        {
                print "hello";
                print res$stdout;
        }
}
{code}

notworking.bro (ran as bro -r my.pcap notworking.bro:
{code:java}
@load base/utils/exec
@load base/frameworks/files
@load base/frameworks/notice

redef exit_only_after_terminate=T;

event file_new(f: fa_file)
    {
        local t ="ls /";
        local cmd = Exec::Command($cmd=t);
        when (local res = Exec::run(cmd))
        {
                print "hello";
                print res$stdout;
        }
    }

{code}





--
This message was sent by Atlassian JIRA
(v7.0.0-OD-04-018#70102)


More information about the bro-dev mailing list