[Zeek] Event namespaces

[Jeff Barber]

Ah. Thanks, Jim.

That's what I wanted to understand: From your second link, it's clear that
the "global" declaration on the event is what causes the issue. If you
simply define an event (without global) and use it within the same script
file, there seems to be no problem.

Cheers,
Jeff



On Wed, Oct 23, 2019 at 1:15 PM Jim Mellander <jmellander at lbl.gov> wrote:

> Take a look at these: https://github.com/zeek/zeek/issues/163 &
> https://bro-tracker.atlassian.net/browse/BIT-984
>
> I've run into this issue, and my best practice is to use fully scoped
> event names, which is the recommended workaround.
>
> Jim
>
>
> On Wed, Oct 23, 2019 at 11:34 AM Jeff Barber <jsbarber60 at gmail.com> wrote:
>
>> At
>> https://docs.zeek.org/en/stable/frameworks/broker.html#a-reminder-about-events-and-module-namespaces,
>> following a code sample, there is the statement:
>>
>> *This code runs without errors, however, the local my_event handler will
>> never be called and also not any remote handlers either, even if
>> Broker::auto_publish was used elsewhere for it. *
>>
>>
>> My tests have not supported that assertion: the event handler is invoked
>> - even via auto_publish. If it is so, how/when exactly would it manifest?
>> Are there other factors that might cause it to be true in some cases? (Say,
>> the same event name in a different namespace?)
>>
>> Just trying to figure out how careful I need to be of namespace issues.
>> My tests have generally shown that if you get the namespace of some script
>> element wrong, the script parsing stage gives you an 'undefined' right out
>> of the gate.
>>
>> Thanks,
>> Jeff
>>
>> _______________________________________________
>> Zeek mailing list
>> zeek at zeek.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20191023/e4b5ccf5/attachment.html