[Bro] ignoring ContentGap and friends

Vern Paxson vern at icir.org
Mon Dec 8 13:38:10 PST 2008


> redef notice_action_filters += {
>      WeirdActivity, ContentGap = ignore_notice,
> };

Along with the scoping issues that others have discussed, there's
a syntax problem here (which explains your follow-on problem).  The
above needs to be:

	redef notice_action_filters += {
		[[Weird::WeirdActivity, Weird::ContentGap]] = ignore_notice,
	};

- Vern



More information about the Bro mailing list