Re: Creating a module and accessing an event in another script

Do you think it might be because I am relying on ssh_auth_result which is
exported in module GLOBAL as seen in SSH/main.zeek? rather than log_ssh
event?. My understanding was that if exported globally it is available for
all scripts which is true when I use it in my own module. But maybe its not
triggered when I try to ssh into the box since log_ssh is the only event
exported from module SSH?

If so how can I export ssh_auth_result to module SSH as well? also how can
I pass two events to a log stream? ie how to edit this line:
Log::create_stream(SSHAttempt::LOG,
[$columns=Info, $ev=log_sshattempt, $path="SSHAttempt"]);

Kind regards,
Merril.

On Wed, 5 Jun 2019 at 09:03, Merril Mathew <[email protected]>
wrote:

> Hi Jon,
>
> Yes I have MailTo option set to my email address in zeekcontrol.
>
> Kind regards,
> Merril.
>
> > On 4 Jun 2019, at 17:43, Jon Siwek <[email protected]> wrote:
> >
> > On Tue, Jun 4, 2019 at 9:34 AM Merril Mathew
> > <[email protected]> wrote:
> >
> >> But the notice email action does not work though. It generates
> notice.log but does not email. Any silly mistakes anyone can see?
> >
> > Do you also have "Notice::mail_dest" set to the email address that
> > should receive them?  Or if you're using ZeekControl / BroControl,
> > you'd instead edit zeekctl.cfg/broctl.cfg to set the "MailTo" option.
> >
> > - Jon
>
>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek