[Bro-Dev] input-framework reporter_error vs reporter_warning events ?

[Johanna Amann]

Hi Aashish,

This changed with Bro 2.5.1. To quote NEWS:

- The input framework's Ascii reader is now more resilient. If an input
   is marked to reread a file when it changes and the file didn't exist
   during a check Bro would stop watching the file in previous versions.
   The same could happen with bad data in a line of a file.  These
   situations do not cause Bro to stop watching input files anymore. The
   old behavior is available through settings in the Ascii reader.

Johanna

On 20 Apr 2018, at 14:09, Aashish Sharma wrote:

> While testing other stuff, I realized that if input-framework cannot 
> find a file
> its now generating reporter_warning event instead of reporter_error ?
>
> Did "error" changed to "warning" for some reason ? Wasn't previously 
> this a
> error condition ?
>
>
> 0.000000        Reporter::WARNING       
> /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init: 
> cannot open /DATA/feeds/BRO-feeds/WIRED.blocknet.2    (empty)
>
>
> 1) Also in what situations input-framework would generate WARNINGS vs 
> ERRORS ?
>
> 2) Does warnings means READER_ASCII will try to read file again after 
> some time
> or does it just gives up and waits for me to tap into reporter_warning 
> event to
> handle the situation ?
>
> Thanks,
> Aashish
> _______________________________________________
> bro-dev mailing list
> bro-dev at bro.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev