[Bro] Writing to SSL log

[Neslog]

I used the ssl_established event and appears to be a bit of a race
condition for what I'm doing.  I'm pulling in some data from broker and
deliver from broker is slower than network traffic....



On Thu, Sep 13, 2018 at 3:59 PM Neslog <neslog at gmail.com> wrote:

> lol, alright.  I'll test it out in 2.6.  Thanks.
>
> On Thu, Sep 13, 2018 at 3:53 PM Azoff, Justin S <jazoff at illinois.edu>
> wrote:
>
>>
>> > On Sep 13, 2018, at 3:46 PM, Neslog <neslog at gmail.com> wrote:
>> >
>> > Justin, thanks!  I remember having to use a different before to log
>> it.  I loaded up ssl and the following script but it's not firing off.
>> >
>> > test.bro:
>> >
>> > hook ssl_finishing(c: connection) {
>> >   print "SSL Finishing Event!";
>> > }
>> >
>> > Is there much of a delay for this to execute?
>>
>> Oh, that's what I get for not testing on 2.5.x.  That hook is new and
>> will be in 2.6, for now you would need
>> to use the event ssl_established.
>>
>>
>> —
>> Justin Azoff
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180913/958e0bf3/attachment.html