Bro: "weird_file: undeclared variable"
Vern Paxson
vern at ee.lbl.gov
Tue Feb 13 01:55:48 PST 2001
> I just compiled the bro.7a48 vers and ran.
> it ran for the first time and went to listening mode on the port i
> specified. .."listening on eth0"
>
> i stopped it. The next time i run it gives..
>
> policy/login.bro, line 362 (weird_file): error, undeclared variable
> policy/login.bro, line 404 (weird_file): error, undeclared variable
> policy/login.bro, line 409 (weird_file): error, undeclared variable
> policy/login.bro, line 414 (weird_file): error, undeclared variable
>
> I have'nt changed anything.
>
> Has anyone seen this problem ?
The problem is this. The first time you're running Bro, it's creating a
"weird" file to record unusual events. The name of this file is
"weird.$BRO_ID", but if you haven't set $BRO_ID then it's just "weird".
However, login.bro contains "@load weird", which instructs Bro to look
for a policy file called "weird" or "weird.bro". The first of these
is the problem, it's loading the empty file it just created rather than
policy/weird.bro.
Workaround: set $BRO_ID before running.
Probably the correct longer term fix is to have a default name that still
has a suffix (probably ".log").
Vern
More information about the Bro
mailing list