Re: ActiveHTTP Module Error
Jon Siwek <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAMzgZ0K4xr5MsNcKLkgMi7pHnBRdi0N6Y4-WySgV5A4s-GyAOA@mail.gmail.com> |
On Tue, Jun 4, 2019 at 10:06 AM Blake Moss <[email protected]> wrote: > Does anyone have an example of using this in a script they would be willing to share? There's an example in testing/btest/scripts/base/utils/active-http.test. In your example, if you're running from the command line and/or reading a pcap, you need to add this: redef exit_only_after_terminate = T; That is, "when" statements and the ActiveHTTP modules are executed asynchronously. The block of code within the "when" gets executed whenever the results are ready, and if you're on command-line without an indefinite source of input, the process exits before the results are obtained. - Jon _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek