[Bro] Fixing deprecated scripts

James Lay jlay at slave-tothe-box.net
Fri Jun 12 10:58:17 PDT 2015


On Fri, 2015-06-12 at 10:27 -0700, Aashish Sharma wrote:

> OK, I have updated the script on git-hub. Should work now. 
> 
> Let me know if you still see problems:
> 
> https://github.com/initconf/smtp-analysis/blob/master/smtp-embedded-url-bloom.bro
> 
> Thanks, 
> Aashish 
> 
> On Fri, Jun 12, 2015 at 11:05:28AM -0600, James Lay wrote:
> > 
> >    On Fri, 2015-06-12 at 09:58 -0700, Aashish Sharma wrote:
> > 
> > Sorry for catching up on this late. 
> > 
> > I take you got script working now. If not, let me know, I will send a revised v
> > ersion. 
> > 
> > Thanks, 
> > Aashish 
> > 
> > On Thu, Jun 11, 2015 at 06:41:51AM -0600, James Lay wrote:
> > > 
> > >    On Wed, 2015-06-10 at 20:55 -0600, James Lay wrote:
> > > 
> > >      On Wed, 2015-06-10 at 20:07 -0500, Chris Walsh wrote:
> > > 
> > > >From [1][1]https://www.bro.org/documentation/beta/NEWS.bro.html, under Depre
> > cated
> > >  Functionality:
> > >
> > >
> > >         • split: use split_string instead.
> > >
> > > I just did this in another script  2 minutes before your mail hit my mailbox
> > :^
> > > )
> > >
> > > cw
> > > On Jun 10, 2015, at 7:02 PM, James Lay <[2][2]jlay at slave-tothe-box.net> wrote
> > :
> > >
> > > > Topic says it...I have the excellent smtp-embedded-url-bloom.bro which I us
> > e
> > > almost every day for looking up links.  Upon upgrading to 2.4 I see:
> > > >
> > > > error in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line
> > 40
> > > : value used but not set (bloomfilter_basic_init)
> > > > warning in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, lin
> > e
> > > 73: deprecated (split)
> > > >
> > > > I read in the release notes that split was going away.  So now, what do I u
> > se
> > >  to fix it?  I'm including this in the email as I'm not able to find it onlin
> > e.
> > >   Thank you.
> > >
> > >      Thanks Chris and Vlad, changing split_string fixed the warning, but did
> > >      not fix the error at line 40 which halts bro from running.  Any reason
> > >      why:
> > >      global mail_links = bloomfilter_basic_init(0.00000001, 10000000) ;
> > >      causes this issue?  This worked just fine with 2.3.2.  Thank you.
> > >      James
> > > _______________________________________________
> > > Bro mailing list
> > > [3][3]bro at bro-ids.org
> > > [4][4]http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > >
> > >    Looks like this showed up last year:
> > >    [5][5]http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.h
> > tml
> > >    Is there something I need to do on my end?  Thank you.,
> > >    James
> > >
> > > References
> > >
> > >    1. [6]https://www.bro.org/documentation/beta/NEWS.bro.html
> > >    2. [7]mailto:jlay at slave-tothe-box.net
> > >    3. [8]mailto:bro at bro-ids.org
> > >    4. [9]http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > >    5. [10]http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.
> > html
> > 
> > > _______________________________________________
> > > Bro mailing list
> > > [11]bro at bro-ids.org
> > > [12]http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > 
> > 
> >    I have not...the split issue is fine, the
> >    error in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line
> >    40 : value used but not set (bloomfilter_basic_init)
> >    is not.  Thank you.
> >    James
> > 
> > References
> > 
> >    1. https://www.bro.org/documentation/beta/NEWS.bro.html
> >    2. mailto:jlay at slave-tothe-box.net
> >    3. mailto:bro at bro-ids.org
> >    4. http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> >    5. http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.html
> >    6. https://www.bro.org/documentation/beta/NEWS.bro.html
> >    7. mailto:jlay at slave-tothe-box.net
> >    8. mailto:bro at bro-ids.org
> >    9. http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> >   10. http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.html
> >   11. mailto:bro at bro-ids.org
> >   12. http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> 


Thank you so much Aashish....that completely fixed it up.

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150612/04dbb0ba/attachment.html 


More information about the Bro mailing list