[Bro] Fixing deprecated scripts
James Lay
jlay at slave-tothe-box.net
Fri Jun 12 10:58:17 PDT 2015
On Fri, 2015-06-12 at 10:27 -0700, Aashish Sharma wrote:
> OK, I have updated the script on git-hub. Should work now.
>
> Let me know if you still see problems:
>
> https://github.com/initconf/smtp-analysis/blob/master/smtp-embedded-url-bloom.bro
>
> Thanks,
> Aashish
>
> On Fri, Jun 12, 2015 at 11:05:28AM -0600, James Lay wrote:
> >
> > On Fri, 2015-06-12 at 09:58 -0700, Aashish Sharma wrote:
> >
> > Sorry for catching up on this late.
> >
> > I take you got script working now. If not, let me know, I will send a revised v
> > ersion.
> >
> > Thanks,
> > Aashish
> >
> > On Thu, Jun 11, 2015 at 06:41:51AM -0600, James Lay wrote:
> > >
> > > On Wed, 2015-06-10 at 20:55 -0600, James Lay wrote:
> > >
> > > On Wed, 2015-06-10 at 20:07 -0500, Chris Walsh wrote:
> > >
> > > >From [1][1]https://www.bro.org/documentation/beta/NEWS.bro.html, under Depre
> > cated
> > > Functionality:
> > >
> > >
> > > • split: use split_string instead.
> > >
> > > I just did this in another script 2 minutes before your mail hit my mailbox
> > :^
> > > )
> > >
> > > cw
> > > On Jun 10, 2015, at 7:02 PM, James Lay <[2][2]jlay at slave-tothe-box.net> wrote
> > :
> > >
> > > > Topic says it...I have the excellent smtp-embedded-url-bloom.bro which I us
> > e
> > > almost every day for looking up links. Upon upgrading to 2.4 I see:
> > > >
> > > > error in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line
> > 40
> > > : value used but not set (bloomfilter_basic_init)
> > > > warning in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, lin
> > e
> > > 73: deprecated (split)
> > > >
> > > > I read in the release notes that split was going away. So now, what do I u
> > se
> > > to fix it? I'm including this in the email as I'm not able to find it onlin
> > e.
> > > Thank you.
> > >
> > > Thanks Chris and Vlad, changing split_string fixed the warning, but did
> > > not fix the error at line 40 which halts bro from running. Any reason
> > > why:
> > > global mail_links = bloomfilter_basic_init(0.00000001, 10000000) ;
> > > causes this issue? This worked just fine with 2.3.2. Thank you.
> > > James
> > > _______________________________________________
> > > Bro mailing list
> > > [3][3]bro at bro-ids.org
> > > [4][4]http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > >
> > > Looks like this showed up last year:
> > > [5][5]http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.h
> > tml
> > > Is there something I need to do on my end? Thank you.,
> > > James
> > >
> > > References
> > >
> > > 1. [6]https://www.bro.org/documentation/beta/NEWS.bro.html
> > > 2. [7]mailto:jlay at slave-tothe-box.net
> > > 3. [8]mailto:bro at bro-ids.org
> > > 4. [9]http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > > 5. [10]http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.
> > html
> >
> > > _______________________________________________
> > > Bro mailing list
> > > [11]bro at bro-ids.org
> > > [12]http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> >
> >
> > I have not...the split issue is fine, the
> > error in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line
> > 40 : value used but not set (bloomfilter_basic_init)
> > is not. Thank you.
> > James
> >
> > References
> >
> > 1. https://www.bro.org/documentation/beta/NEWS.bro.html
> > 2. mailto:jlay at slave-tothe-box.net
> > 3. mailto:bro at bro-ids.org
> > 4. http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > 5. http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.html
> > 6. https://www.bro.org/documentation/beta/NEWS.bro.html
> > 7. mailto:jlay at slave-tothe-box.net
> > 8. mailto:bro at bro-ids.org
> > 9. http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > 10. http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.html
> > 11. mailto:bro at bro-ids.org
> > 12. http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
Thank you so much Aashish....that completely fixed it up.
James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150612/04dbb0ba/attachment.html
More information about the Bro
mailing list