On Mar 13, 2014, at 2:17 AM, Bernhard Amann <[email protected]> wrote:
> You apparently have to be very careful which EndOfFile function of > the file analysis framework you call... otherwhise it might try > to close another file id. This took me quite a while to find. I think that should be the case for any methods of the file analysis interface that don’t use a pre-computed file id, but only if the file handles returned from the script layer “get_file_handle” function end up differing between calls to the file analysis interface. So the question I’d try to answer would be “are the file handles returned from my get_file_handle function differing unintentionally?” Ultimately, moving to the pre-computed file id interface like you did makes sense for this code since you know the two calls to the file analysis interface right next to each other are associated w/ the same file. - Jon _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
