[Bro] [Fwd] Re: Bro 1.4, another pre-release

[Robin Sommer]

(Below a reply I sent earlier in private mail. Miguel, please don't
send a question separately both in private mail and on the list,
thanks.)

Robin

----- Forwarded message from Robin Sommer <robin at icir.org> -----

From: Robin Sommer <robin at icir.org>
Date: Tue, 12 Aug 2008 10:09:25 -0700
Subject: Re: [Bro] Bro 1.4, another pre-release
To: Miguel Angel Calvo Moya <mangel12321 at hotmail.com>
Message-ID: <20080812170925.GC5416 at icir.org>


On Tue, Aug 12, 2008 at 18:03 +0200, you wrote:

> line 1: warning: event handlers never invoked:
> line 1: warning:         Drop::restore_dropped_address

This is actually expected and harmless. It says that Bro sees an
handler for an event yet based on the scripts you load can tell that
the event will never actually be raised. In this case, that's
because your configuration never calls the function
Drop::drop_address (which is a rare thing to do anyway).

There's a switch to suppress these warnings:

        # If true, warns about unused event handlers at startup.
        const check_for_unused_event_handlers = T &redef;

I've already been wondering whether we should change this to off by
default. 

> Also I noticed there is no longer a 'site' folder. Where would be
> the right place to place our host-specific Bro policy file?

Hmmm... Good question, didn't think about that when redoing the
default installation. How about $prefix/share/bro/site? Looks like 
"make install" should then create that directory if it doesn't
exist.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

----- End forwarded message -----





-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org