Re: Creating a module and accessing an event in another script

On Tue, Jun 4, 2019 at 8:56 AM Merril Mathew
<[email protected]> wrote:

> I created a module called SSHAttempt under /usr/local/bro/share/bro/site and set up the module with __local__.zeek and main.zeek.

The magic filename for loading directories is "__load__.zeek", not
"__local__.zeek".

> However if I try to access the event that has been exported from SSHAttempt/main.zeek inside another script (test.zeek) then I am getting the error that the record values are not initialised. I was expecting auth_fail variable inside SSHAttempt::Info record to be initialised when running .pcap.

The event handler in test.zeek was creating an uninitialized record
and printing it instead of printing the one given as an argument like:

event log_sshattempt(rec: Info) &priority=5
    {
    print rec;
    }

- Jon

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek