[Bro-Dev] input-framework reporter_error vs reporter_warning events ?

Aashish Sharma asharma at lbl.gov
Fri Apr 20 14:39:32 PDT 2018


Hah! Should have checked change notes more carefully!

No wonder a bunch of pre 2.5.1 scripts never complained :) they all were tapping
into event reporter_error. I'll forward port those now.

Thanks Johanna! 

Aashish 

On Fri, Apr 20, 2018 at 02:34:13PM -0700, Johanna Amann wrote:
> Hi Aashish,
> 
> This changed with Bro 2.5.1. To quote NEWS:
> 
> - The input framework's Ascii reader is now more resilient. If an input
>   is marked to reread a file when it changes and the file didn't exist
>   during a check Bro would stop watching the file in previous versions.
>   The same could happen with bad data in a line of a file.  These
>   situations do not cause Bro to stop watching input files anymore. The
>   old behavior is available through settings in the Ascii reader.
> 
> Johanna
> 
> On 20 Apr 2018, at 14:09, Aashish Sharma wrote:
> 
> > While testing other stuff, I realized that if input-framework cannot
> > find a file
> > its now generating reporter_warning event instead of reporter_error ?
> > 
> > Did "error" changed to "warning" for some reason ? Wasn't previously
> > this a
> > error condition ?
> > 
> > 
> > 0.000000        Reporter::WARNING
> > /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init: cannot
> > open /DATA/feeds/BRO-feeds/WIRED.blocknet.2    (empty)
> > 
> > 
> > 1) Also in what situations input-framework would generate WARNINGS vs
> > ERRORS ?
> > 
> > 2) Does warnings means READER_ASCII will try to read file again after
> > some time
> > or does it just gives up and waits for me to tap into reporter_warning
> > event to
> > handle the situation ?
> > 
> > Thanks,
> > Aashish
> > _______________________________________________
> > bro-dev mailing list
> > bro-dev at bro.org
> > http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev


More information about the bro-dev mailing list