Hah! Should have checked change notes more carefully! No wonder a bunch of pre 2.5.1 scripts never complained :) they all were tapping into event reporter_error. I'll forward port those now.
Thanks Johanna! Aashish On Fri, Apr 20, 2018 at 02:34:13PM -0700, Johanna Amann wrote: > Hi Aashish, > > This changed with Bro 2.5.1. To quote NEWS: > > - The input framework's Ascii reader is now more resilient. If an input > is marked to reread a file when it changes and the file didn't exist > during a check Bro would stop watching the file in previous versions. > The same could happen with bad data in a line of a file. These > situations do not cause Bro to stop watching input files anymore. The > old behavior is available through settings in the Ascii reader. > > Johanna > > On 20 Apr 2018, at 14:09, Aashish Sharma wrote: > > > While testing other stuff, I realized that if input-framework cannot > > find a file > > its now generating reporter_warning event instead of reporter_error ? > > > > Did "error" changed to "warning" for some reason ? Wasn't previously > > this a > > error condition ? > > > > > > 0.000000 Reporter::WARNING > > /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init: cannot > > open /DATA/feeds/BRO-feeds/WIRED.blocknet.2 (empty) > > > > > > 1) Also in what situations input-framework would generate WARNINGS vs > > ERRORS ? > > > > 2) Does warnings means READER_ASCII will try to read file again after > > some time > > or does it just gives up and waits for me to tap into reporter_warning > > event to > > handle the situation ? > > > > Thanks, > > Aashish > > _______________________________________________ > > bro-dev mailing list > > bro-dev@bro.org > > http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
