[Bro] Problem running Bro in command line

Vern Paxson vern at icir.org
Thu Oct 8 22:09:47 PDT 2009


When reporting Bro problems like this, it's important to say under what
system you're running and what version of Bro you're using.

> For large files something goes wrong (looks like the pipe going to 
> bro stdin backs up, or something).

We feed Bro very large files via -r and haven't encountered this problem.

The first step is to attach a debugger (after configuring with --enable-debug
and rebuilding) to see whether it's indeed blocked waiting for input, or
instead stuck doing something else.

> I used to have problems on bro not flusing to stdout, so I used 
> flush_all() after print statements in my bro script and that seemed to work.
> Is there a similar command to force bro to read data in stdin?

No, and it definitely shouldn't be needed.

		Vern



More information about the Bro mailing list