# Bro manager crashing

**URL:** <https://community.zeek.org/t/bro-manager-crashing/2937>\
**Category:** Zeek\
**Created:** [December 14, 2013, 6:19am UTC](https://community.zeek.org/t/bro-manager-crashing/2937 "2013-12-14T06:19:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Konrad\_Weglowski1](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@Konrad\_Weglowski1](https://community.zeek.org/u/Konrad_Weglowski1)\
**Post date:** [December 14, 2013, 6:19am UTC](https://community.zeek.org/t/bro-manager-crashing/2937/1 "2013-12-14T06:19:56Z")

</div>

Hello,

When I uncommented the following line in /opt/bro/share/bro/site/local.bro to enable email alerts on notice alarms and did install and restart on broctl Bro Manager is crashing.

redef Notice::policy += { [$action = Notice::ACTION\_ALARM, $priority = 0] };

I get the following error message via email notification. I am running BRO as a part of the Security Onion.

When I comment the line back, Manager starts but I do not think emails on notices will.

Thank you again

Konrad

_If you want to help us debug this problem, then please forward this mail to [reports@bro.org](mailto:reports@bro.org)_

_Bro 2.2_  
_Linux 3.2.0-57-generic_

_==== No reporter.log_

_==== stderr.log_  
_error in /opt/bro/share/bro/base/_  
\*frameworks/notice/./main.bro, line 182 and /nsm/bro/spool/installed-\*\*scripts-do-not-touch/site/\*_local.bro, line 35: already defined (Notice::policy)_

_==== stdout.log_  
_unlimited_  
_unlimited_  
_unlimited_

_==== .cmdline_  
_-U .status -p broctl -p broctl-live -p local -p manager local.bro broctl base/frameworks/cluster local-manager.bro broctl/auto_

_==== .env\_vars_  
\*PATH=/opt/bro/bin:/opt/bro/\*\*share/broctl/scripts:/usr/\*\*local/sbin:/usr/local/bin:/\*\*usr/sbin:/usr/bin:/sbin:/bin:/\*_opt/bro/bin_  
\*BROPATH=/nsm/bro/spool/\*\*installed-scripts-do-not-\*\*touch/site::/nsm/bro/spool/\*\*installed-scripts-do-not- **touch/auto:/opt/bro/share/bro:** /opt/bro/share/bro/policy:/\*_opt/bro/share/bro/site_  
_CLUSTER\_NODE=manager_

_==== .status_  
_TERMINATED [atexit]_

_==== No prof.log_

_==== No packet\_filter.log_

_==== No loaded\_scripts.log_

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [December 16, 2013, 3:26pm UTC](https://community.zeek.org/t/bro-manager-crashing/2937/2 "2013-12-16T15:26:06Z")

</div>

Unfortunately, that commented-out example in local.bro doesn’t reflect how to actually use Notice::policy in Bro 2.2. Using code like the following should be equivalent:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;hook Notice::policy(n: Notice::Info)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add n$actions[Notice::ACTION\_ALARM];  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

- Jon

---

<div class="post-metadata">

**Author:** ![Konrad\_Weglowski1](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@Konrad\_Weglowski1](https://community.zeek.org/u/Konrad_Weglowski1)\
**Post date:** [December 17, 2013, 9:31am UTC](https://community.zeek.org/t/bro-manager-crashing/2937/3 "2013-12-17T09:31:03Z")

</div>

Hello Jon,

Thank you for very much. I put this directly inside local.bro. Is that the right way of doing it or should I be inserting this in another or a new file and then loading it inside local.bro?

Thanks,

Konrad

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [December 17, 2013, 3:18pm UTC](https://community.zeek.org/t/bro-manager-crashing/2937/4 "2013-12-17T15:18:48Z")

</div>

Whichever is easiest for you, but the later is probably preferable to maintain and more clearly separate local code additions from the upstream version.

- Jon

---

<div class="post-metadata">

**Author:** ![Konrad\_Weglowski1](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@Konrad\_Weglowski1](https://community.zeek.org/u/Konrad_Weglowski1)\
**Post date:** [December 18, 2013, 8:57am UTC](https://community.zeek.org/t/bro-manager-crashing/2937/5 "2013-12-18T08:57:29Z")

</div>

Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-manager-crashing/2937/6 "2022-05-06T15:41:27Z")

</div>


