# bro, telnet.log

**URL:** <https://community.zeek.org/t/bro-telnet-log/5504>\
**Category:** Zeek\
**Created:** [October 26, 2018, 6:42am UTC](https://community.zeek.org/t/bro-telnet-log/5504 "2018-10-26T06:42:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![qingyu\_chang](https://avatars.discourse-cdn.com/v4/letter/q/f14d63/32.png) [@qingyu\_chang](https://community.zeek.org/u/qingyu_chang)\
**Post date:** [October 26, 2018, 6:42am UTC](https://community.zeek.org/t/bro-telnet-log/5504/1 "2018-10-26T06:42:07Z")

</div>

Hi, i’m writing a bro script to generate telnet.log, as showing in attachment. But when i simulate several remote telnet login actions, bro could’t record all the login actions completely, lost nearly half. And if i run this script with PCAPs, it tuns out to be normal. Thanks for read my letter.

[main.bro](https://community.zeek.org/uploads/short-url/gLx6RL66srPmMg9irMTIJiOayJ6.bro) (2.95 KB)

---

<div class="post-metadata">

**Author:** ![Nicolas\_KRASINSKI](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nicolas\_KRASINSKI](https://community.zeek.org/u/Nicolas_KRASINSKI)\
**Post date:** [October 26, 2018, 1:39pm UTC](https://community.zeek.org/t/bro-telnet-log/5504/2 "2018-10-26T13:39:48Z")

</div>

```auto
Hello,

I want bro to send email when a note is seen. 
I try adding these to local.bro :

redef Notice::emailed_types += {
 Address_Scan,
 Port_Scan,
};
hook Notice::policy(n: Notice::Info)
   {
if (n$note in Notice::emailed_types)
add n$actions[Notice::ACTION_EMAIL];
    }

Or this 

hook Notice::policy(n: Notice::Info)
   {
if (n$note == Address_Scan)
add n$actions[Notice::ACTION_EMAIL];
   }
 

But when I do broctl check I have this error : 

error in /usr/local/bro/share/bro/site/local.bro, line 13: unknown identifier Address_Scan, at or near "Address_Scan"

The script policy/misc/scan.bro is well loaded.

Thanks a lot !

Nicolas.

```

---

<div class="post-metadata">

**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\
**Post date:** [October 26, 2018, 2:25pm UTC](https://community.zeek.org/t/bro-telnet-log/5504/3 "2018-10-26T14:25:07Z")

</div>

Replace Address\_Scan with Scan::Address\_Scan and Port\_Scan with Scan::Port\_Scan and try again. You have to identify the module that those names are in.

---

<div class="post-metadata">

**Author:** ![Nicolas\_KRASINSKI](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nicolas\_KRASINSKI](https://community.zeek.org/u/Nicolas_KRASINSKI)\
**Post date:** [October 26, 2018, 2:36pm UTC](https://community.zeek.org/t/bro-telnet-log/5504/4 "2018-10-26T14:36:34Z")

</div>

Thanks, but what are you meaning by identify the module that those names are in ?  
I changed the Address\_Scan by Scan::Address\_Scan, but same…  
I added “module Scan;” in local.bro but same error.

When I add this directly in scan.bro, it works, but it is not advisable…

hook Notice::policy(n: Notice::Info)  
{  
if (n$note == Address\_Scan)  
add n$actions[Notice::ACTION\_EMAIL];  
}

---

<div class="post-metadata">

**Author:** ![Nicolas\_KRASINSKI](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nicolas\_KRASINSKI](https://community.zeek.org/u/Nicolas_KRASINSKI)\
**Post date:** [October 26, 2018, 4:35pm UTC](https://community.zeek.org/t/bro-telnet-log/5504/5 "2018-10-26T16:35:14Z")

</div>

Ok, I found the solution, I added in my local.bro :

**@load misc/scan**

with the code :

**hook Notice::policy(n: Notice::Info)**  
**{**  
**if ( n$note == Scan::Address\_Scan || n$note == Scan::Port\_Scan )**  
**add n$actions[Notice::ACTION\_EMAIL];**  
**}**

and it works fine.  
Thank you,

Nicolas.

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [October 29, 2018, 4:48pm UTC](https://community.zeek.org/t/bro-telnet-log/5504/6 "2018-10-29T16:48:12Z")

</div>

I can’t speak to why you’re only seeing some of the messages unless you’re using a pcap. However, I’m curious what version of Bro you’re running. I believe the telnet analyzer was removed prior to 2.x precisely because it was inaccurate.

-Dop

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-telnet-log/5504/7 "2022-05-06T15:46:08Z")

</div>