about event handle

Zeek
1

> in main(...):add some code like
> Func * wsf;
> wsf=internal_func("wsf");
>
> in bro.init:add a line as
> global wsf: event (msg: string);
> in login.bro: add a event as
> event wsf (msg: string)
> {
> print msg;
> }
> And when I invoke bro : ./bro -i eth0 login.bro , bro does not work ,

with

> the error information :
> lin1: internal error: internal variable wsf missing
> Aborted .
> Did I get the right way of creating and using event handle?

That's the correct way. Perhaps you're running into search-path problems,
in which the old version of bro.init is being found rather than the new
version you created. (Not the problem, of course, if you edited bro.init
in place rather than creating a new one.) The way to debug this is to
check the access time on the modified bro.init using "ls -lu" in order
to see whether it's indeed being read in. If it is, the next thing to
do is to introduce a syntax error in the definition of wsf to see whether
the line is indeed being parsed.

Thanks for your help.:slight_smile:
The access time on the modified bro.init before running bro is the same to the time after running bro. What shoul I do to make the bro read the bro.init?

Have a nice day
Ciao
             Cloud