[Zeek] ActiveHTTP Module Error

[Blake Moss]

Great, that is what I was missing! Thank you!

________________________________
From: Jon Siwek <jsiwek at corelight.com>
Sent: Tuesday, June 4, 2019 11:19:49 AM
To: Blake Moss
Cc: zeek at zeek.org
Subject: Re: [Zeek] ActiveHTTP Module Error

On Tue, Jun 4, 2019 at 10:06 AM Blake Moss <blake_moss at byu.edu> wrote:

> Does anyone have an example of using this in a script they would be willing to share?

There's an example in
testing/btest/scripts/base/utils/active-http.test.  In your example,
if you're running from the command line and/or reading a pcap, you
need to add this:

    redef exit_only_after_terminate = T;

That is, "when" statements and the ActiveHTTP modules are executed
asynchronously.  The block of code within the "when" gets executed
whenever the results are ready, and if you're on command-line without
an indefinite source of input, the process exits before the results
are obtained.

- Jon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20190604/4ab7ffec/attachment.html