[Bro] log writer issue

[Azoff, Justin S]

> On Dec 29, 2015, at 9:34 AM, György Miru <mirugy at gmail.com> wrote:
> 
> This happens before the first event is logged, however the headers are already written into the logfile

Was there a stderr.log ?

Does it happen before the event would have been logged at all, or in the process of logging the event?

If you add a

    print "This is siemenss7_write_data_unsigned"; #or siemenss7_read_data_unsigned
    print c$s7data;

before the calls to

    Log::write(S7comm::LOG3, c$s7data);

what gets output to stdout (or the stdout.log if you are using broctl)?

I think this may be caused by one of the fields in one of your events being invalid somehow...

> debug_s7data.log: relevant part of the debug.log file, when bro was run with -B threading switch

You really want -B logging

I have a feeling you'll see a "Field type doesn't match in WriterBackend::Write" message

-- 
- Justin Azoff