[Bro-Dev] input-framework reporter_error vs reporter_warning events ?
johanna at icir.org
Fri Apr 20 14:34:13 PDT 2018
This changed with Bro 2.5.1. To quote NEWS:
- The input framework's Ascii reader is now more resilient. If an input
is marked to reread a file when it changes and the file didn't exist
during a check Bro would stop watching the file in previous versions.
The same could happen with bad data in a line of a file. These
situations do not cause Bro to stop watching input files anymore. The
old behavior is available through settings in the Ascii reader.
On 20 Apr 2018, at 14:09, Aashish Sharma wrote:
> While testing other stuff, I realized that if input-framework cannot
> find a file
> its now generating reporter_warning event instead of reporter_error ?
> Did "error" changed to "warning" for some reason ? Wasn't previously
> this a
> error condition ?
> 0.000000 Reporter::WARNING
> /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init:
> cannot open /DATA/feeds/BRO-feeds/WIRED.blocknet.2 (empty)
> 1) Also in what situations input-framework would generate WARNINGS vs
> ERRORS ?
> 2) Does warnings means READER_ASCII will try to read file again after
> some time
> or does it just gives up and waits for me to tap into reporter_warning
> event to
> handle the situation ?
> bro-dev mailing list
> bro-dev at bro.org
More information about the bro-dev