[cliff@oradata bro-pub-0.9a3]$ ./bro mt -i eth0
input in flex scanner failed
I tracked this down (and fixed it). The problem is that reading the file
"mt" fails in some fashion. The example I was able to reproduce was when
"mt" was a directory rather than a text file. (The same could happen if
"mt.bro" is a directory). Inspect your $BROPATH to see what file it's
opening.
The fix is for a better error message in this case. For example, if "mt"
is a subdirectory in the current directory, you'll get:
./mt, line 1: error: read failed with "Operation not permitted"
I've appended a patch for it, which will be included in the next release.
Vern
RCS file: /home/portnoy/u2/src/projects/bro/src/scan.l,v
retrieving revision 1.4
retrieving revision 1.5
diff -Lsrc/scan.l -Lsrc/scan.l -u -r1.4 -r1.5
--- src/scan.l
+++ src/scan.l
@@ -19,6 +19,8 @@
// WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+#include <errno.h>