Hah! Should have checked change notes more carefully!
No wonder a bunch of pre 2.5.1 scripts never complained :) they all were tapping
into event reporter_error. I'll forward port those now.
On Fri, Apr 20, 2018 at 02:34:13PM -0700, Johanna Amann wrote:
This changed with Bro 2.5.1. To quote NEWS:
- The input framework's Ascii reader is now more resilient. If an input
is marked to reread a file when it changes and the file didn't exist
during a check Bro would stop watching the file in previous versions.
The same could happen with bad data in a line of a file. These
situations do not cause Bro to stop watching input files anymore. The
old behavior is available through settings in the Ascii reader.
On 20 Apr 2018, at 14:09, Aashish Sharma wrote:
> While testing other stuff, I realized that if input-framework cannot
> find a file
> its now generating reporter_warning event instead of reporter_error ?
> Did "error" changed to "warning" for some reason ? Wasn't
> this a
> error condition ?
> 0.000000 Reporter::WARNING
> /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init: cannot
> open /DATA/feeds/BRO-feeds/WIRED.blocknet.2 (empty)
> 1) Also in what situations input-framework would generate WARNINGS vs
> ERRORS ?
> 2) Does warnings means READER_ASCII will try to read file again after
> some time
> or does it just gives up and waits for me to tap into reporter_warning
> event to
> handle the situation ?
> bro-dev mailing list