Bro: "weird_file: undeclared variable"

Vern Paxson vern at ee.lbl.gov
Tue Feb 13 01:55:48 PST 2001


> I just compiled the bro.7a48 vers and ran.
> it ran for the first time and went to listening mode on the port i 
> specified. .."listening on eth0"
> 
> i stopped it. The next time i run it gives..
> 
> policy/login.bro, line 362 (weird_file): error, undeclared variable
> policy/login.bro, line 404 (weird_file): error, undeclared variable
> policy/login.bro, line 409 (weird_file): error, undeclared variable
> policy/login.bro, line 414 (weird_file): error, undeclared variable
> 
> I have'nt changed anything.
> 
> Has anyone seen this problem ?

The problem is this.  The first time you're running Bro, it's creating a
"weird" file to record unusual events.  The name of this file is
"weird.$BRO_ID", but if you haven't set $BRO_ID then it's just "weird".
However, login.bro contains "@load weird", which instructs Bro to look
for a policy file called "weird" or "weird.bro".  The first of these
is the problem, it's loading the empty file it just created rather than
policy/weird.bro.

Workaround: set $BRO_ID before running.

Probably the correct longer term fix is to have a default name that still
has a suffix (probably ".log").

		Vern



More information about the Bro mailing list