Bro manager crashing


When I uncommented the following line in /opt/bro/share/bro/site/local.bro to enable email alerts on notice alarms and did install and restart on broctl Bro Manager is crashing.

redef Notice::policy += { [$action = Notice::ACTION_ALARM, $priority = 0] };

I get the following error message via email notification. I am running BRO as a part of the Security Onion.

When I comment the line back, Manager starts but I do not think emails on notices will.

Thank you again


If you want to help us debug this problem, then please forward this mail to

Bro 2.2
Linux 3.2.0-57-generic

==== No reporter.log

==== stderr.log
error in /opt/bro/share/bro/base/
*frameworks/notice/./main.bro, line 182 and /nsm/bro/spool/installed-**scripts-do-not-touch/site/*local.bro, line 35: already defined (Notice::policy)

==== stdout.log

==== .cmdline
-U .status -p broctl -p broctl-live -p local -p manager local.bro broctl base/frameworks/cluster local-manager.bro broctl/auto

==== .env_vars

==== .status

==== No prof.log

==== No packet_filter.log

==== No loaded_scripts.log

Unfortunately, that commented-out example in local.bro doesn’t reflect how to actually use Notice::policy in Bro 2.2. Using code like the following should be equivalent:

        hook Notice::policy(n: Notice::Info)
            add n$actions[Notice::ACTION_ALARM];

- Jon

Hello Jon,

Thank you for very much. I put this directly inside local.bro. Is that the right way of doing it or should I be inserting this in another or a new file and then loading it inside local.bro?



Whichever is easiest for you, but the later is probably preferable to maintain and more clearly separate local code additions from the upstream version.

- Jon

Thanks again.