[Bro] Problem with http request in Bro

Lubo Gusenica lubo.gusenica at zoznam.sk
Tue Mar 17 17:14:26 PDT 2015


Hello,

I'm trying to use this function in my script:

function find_event(value: string) {
	local url = fmt("%s/%s/ip-src",prefix, value);
	local arg = fmt("--header \"Authorization: %s\"",auth);
	local req = ActiveHTTP::Request($url=url, $addl_curl_args=arg);
	when ( local resp = ActiveHTTP::request(req) )
		{
		print resp;
		}
}

event Intel::match(s: Intel::Seen, items: set [Intel::Item]) {
		find_event(s$indicator);
}


Prefix and auth are global.
Just sometimes it prints response. Most of times it prints

rm: cannot remove `/tmp/bro-activehttp-<id>_body': No such file or 
directory

Can you tell me please what I'm doing wrong or why it is happenning ?
Thank you 



More information about the Bro mailing list