about event handle

Vern Paxson vern at icir.org
Fri Sep 6 09:19:05 PDT 2002

> The access time on the modified bro.init before running bro is the same to 
> the time after running  bro. What shoul I do to make the bro read the 
> bro.init?

Bro searches $BROPATH, which defaults to


so for bro.init it will load the first instance it finds along that path.
You should be able to use ls -ut to find just what files it's loading
along the path.


More information about the Bro mailing list