# bro script question.

**URL:** <https://community.zeek.org/t/bro-script-question/3135>\
**Category:** Zeek\
**Created:** [June 4, 2014, 1:49pm UTC](https://community.zeek.org/t/bro-script-question/3135 "2014-06-04T13:49:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryant\_Thomas](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@Bryant\_Thomas](https://community.zeek.org/u/Bryant_Thomas)\
**Post date:** [June 4, 2014, 1:49pm UTC](https://community.zeek.org/t/bro-script-question/3135/1 "2014-06-04T13:49:57Z")

</div>

All,

&nbsp;&nbsp;&nbsp;I've run a script against a pcap file:

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\
**Post date:** [June 4, 2014, 2:08pm UTC](https://community.zeek.org/t/bro-script-question/3135/2 "2014-06-04T14:08:15Z")

</div>

You want

&nbsp;&nbsp;Log::write(LOG, [$data=str]);

---

<div class="post-metadata">

**Author:** ![Bryant\_Thomas](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@Bryant\_Thomas](https://community.zeek.org/u/Bryant_Thomas)\
**Post date:** [June 4, 2014, 3:21pm UTC](https://community.zeek.org/t/bro-script-question/3135/3 "2014-06-04T15:21:00Z")

</div>

Justin,

&nbsp;&nbsp;&nbsp;I added your line to the connection\_established event:

event connection\_established(c: connection) {  
&nbsp;&nbsp;local str = fmt("Connection established: %s", c$id);  
&nbsp;&nbsp;print fmt("%s\n", str); #TEST  
&nbsp;&nbsp;Log::write(TstRec::LOG, [$data=str]);  
&nbsp;&nbsp;# Log::write(TstLog::LOG, [$data=mkString()]);  
}

&nbsp;&nbsp;and got a different error:

error in ./tstLog.bro, line 14: unknown identifier TstRec::LOG, at or near "TstRec::LOG"

Bro can be very subtle... (subtle = "I don't know how it works!")

Tom

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\
**Post date:** [June 4, 2014, 3:27pm UTC](https://community.zeek.org/t/bro-script-question/3135/4 "2014-06-04T15:27:08Z")

</div>

> Justin,
> 
> &nbsp;&nbsp;&nbsp;I added your line to the connection\_established event:

..

> &nbsp;&nbsp;Log::write(TstRec::LOG, [$data=str]);

...

> You want
> 
> &nbsp;&nbsp;Log::write(LOG, [$data=str]);

Spot the difference 🙂

---

<div class="post-metadata">

**Author:** ![Bryant\_Thomas](https://avatars.discourse-cdn.com/v4/letter/b/85e7bf/32.png) [@Bryant\_Thomas](https://community.zeek.org/u/Bryant_Thomas)\
**Post date:** [June 4, 2014, 5:06pm UTC](https://community.zeek.org/t/bro-script-question/3135/5 "2014-06-04T17:06:54Z")

</div>

Yes!!

That worked.

Thanks Justin.

Tom

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-script-question/3135/6 "2022-05-06T15:41:49Z")

</div>