I just compiled the bro.7a48 vers and ran.
it ran for the first time and went to listening mode on the port i
specified. .."listening on eth0"
i stopped it. The next time i run it gives..
policy/login.bro, line 362 (weird_file): error, undeclared variable
policy/login.bro, line 404 (weird_file): error, undeclared variable
policy/login.bro, line 409 (weird_file): error, undeclared variable
policy/login.bro, line 414 (weird_file): error, undeclared variable
I have'nt changed anything.
Has anyone seen this problem ?
The problem is this. The first time you're running Bro, it's creating a
"weird" file to record unusual events. The name of this file is
"weird.$BRO_ID", but if you haven't set $BRO_ID then it's just "weird".
However, login.bro contains "@load weird", which instructs Bro to look
for a policy file called "weird" or "weird.bro". The first of these
is the problem, it's loading the empty file it just created rather than
Workaround: set $BRO_ID before running.
Probably the correct longer term fix is to have a default name that still
has a suffix (probably ".log").