[Bro] Question on "already defined (Notice::policy)" error

Gary Faulkner gfaulkner.nsm at gmail.com
Thu Oct 9 13:39:14 PDT 2014


Have you tried something like this for defining notices you want emails on:

redef Notice::emailed_types += {
       PacketFilter::Dropped_Packets,
};


On 10/9/2014 2:55 PM, James Lay wrote:
> Hi All,
>
> I'm dabbling with getting Bro to email, so I've added this to my
> local.bro:
>
> redef Notice::mail_dest = "myemail at address.com";
>
> redef Notice::policy += {
>       [$result = Notice::ACTION_EMAIL,
>        $pred(n: Notice::Info) =
>           { return n$note == PacketFilter::Dropped_Packets; }
>       ]
> };
>
> but I'm getting:
>
> error in /usr/local/bro/share/bro/base/frameworks/notice/./main.bro,
> line 183 and /usr/local/bro/share/bro/site/local.bro, line 101: already
> defined (Notice::policy)
>
> Is there something I'm missing?  Thank you.
>
> James
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro




More information about the Bro mailing list