about event handle

Vern Paxson vern at icir.org
Fri Sep 6 00:08:14 PDT 2002


> in main(...):add some code like
>                            Func * wsf;
>                            wsf=internal_func("wsf");
> 
> in bro.init:add a line as 
>                            global wsf: event (msg: string); 
> in login.bro: add a event as
>                            event wsf (msg: string)
>                                 {
>                                  print msg;
>                                  }
> And when I invoke bro : ./bro -i eth0 login.bro , bro does not work , with 
> the error information :
>               lin1: internal error: internal variable wsf missing
>               Aborted .
> Did I get the right way of creating and using event handle?

That's the correct way.  Perhaps you're running into search-path problems,
in which the old version of bro.init is being found rather than the new
version you created.  (Not the problem, of course, if you edited bro.init
in place rather than creating a new one.)  The way to debug this is to
check the access time on the modified bro.init using "ls -lu" in order
to see whether it's indeed being read in.  If it is, the next thing to
do is to introduce a syntax error in the definition of wsf to see whether
the line is indeed being parsed.

		Vern



More information about the Bro mailing list