[Bro] - Exec::run when reading a pcap

william de ping bill.de.ping at gmail.com
Thu Oct 26 07:02:40 PDT 2017


Hi,

I'm having troubles running a simple script on bro 2.5 reading a pcap file:

@load base/utils/exec

#redef exit_only_after_terminate=T;

event bro_init()
{
print "Hello, World!";
local t="echo 123  ; echo 456";
local cmd=Exec::Command($cmd=t);
when (local res = Exec::run(cmd))
    {
     print "start !";
     print res$stdout;
     print "finish !";
    }
}

the exec commands runs successfully on try.bro.org, but prints nothing in
the "when" bracket when running on local bro (v2.5).

Is there a simple way of running a command with arguments and getting its
return value right away ?

system("ls"); works great but by design I can't get its results.

any thoughts ?

Thanks
B
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20171026/28b2c991/attachment.html 


More information about the Bro mailing list