[Bro] Error: value used but not set (bloomfilter_basic_init)

[Xxx, Xxx]

Thank you all for the prompt responses. We implemented Seth's recommendation (initializing in the bro_init handler) and the issue has been resolved.

Seth, I will apply your smtp-url script on the dev server for testing. 

Thanks again,



-----Original Message-----
From: Seth Hall [mailto:seth at icir.org] 
Sent: Monday, October 20, 2014 3:54 PM
To: Xxx, Xxx
Cc: bro at bro.org
Subject: EXT :Re: [Bro] Error: value used but not set (bloomfilter_basic_init)


On Oct 20, 2014, at 2:44 PM, Xxx, Xxx <Xxx.Xxx at Removed.com> wrote:

> This is my first time using the mailing list so please let me know if I need to follow a certain format when asking questions.

Hi.  This is perfectly fine. :)

> global mail_links = bloomfilter_basic_init(0.00000001, 10000000);
>  
> We got the script from GitHub. Looks nearly identical to this:
> https://github.com/initconf/smtp-analysis/blob/master/smtp-embedded-url-bloom.bro

Yeah, I noticed that issue with that script as well.  There is a thread from a while ago where I promised to get that script heavily updated and haven't finished it yet.

If you only declare the type and don't initialize it there then do the call to bloomfilter_basic_init in a bro_init handler it should work.

So, while I was in the middle of writing this email, I went ahead and finished the smtp-url.bro script.  This is very similar to Aashish's smtp-embedded-url-bloom.bro script but has been very lightly tested.  I'd appreciate feedback from anyone that decides to run it. :)

I put the script into the "official" external Bro scripts repository:
	https://github.com/bro/bro-scripts/blob/master/smtp-url.bro

  .Seth


--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/