# broclient and NOTICE() **URL:** \ **Category:** Zeek\ **Created:** [February 17, 2009, 6:34am UTC](https://community.zeek.org/t/broclient-and-notice/1491 "2009-02-17T06:34:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Sean\_McCreary](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@Sean\_McCreary](https://community.zeek.org/u/Sean_McCreary)\ **Post date:** [February 17, 2009, 6:34am UTC](https://community.zeek.org/t/broclient-and-notice/1491/1 "2009-02-17T06:34:00Z")
I'm having trouble feeding events to bro v1.4 using broclient. I built broclient using the source in aux/broccoli/contrib, and configured bro to listen for remote connections. This setup will sometime crash with the run-time error messages like this: > 1234849021.842185 run-time error: peer 10000 does not exist > 1234849021.842185 /usr/local/bro/share/bro/notice.bro, line 261 (n$src\_peer): internal error: field value missing I dug a little in the source, and it seems like n$src\_peer should be set automatically by get\_event\_peer(), and internal function in the event engine. Before digging deeper in the bro source, I thought I'd ask if anyone has seen this before, or if I'm doing something obviously wrong. Here's the relevant bro code that causes the error: > ## Track ssh logins using info from syslog > @load listen-clear > @load remote > > redef listen\_if\_clear = 127.0.0.1; > redef Remote::destinations += { >     ["syslog"] = [$host = 127.0.0.1, $events = /.\*/, $connect=F], > }; > > redef enum Notice += { NewSSHConn }; > global ssh\_conns: set[string, addr, string, string] &persistent; > > redef notice\_policy += { >         # Email when a user logs in from a new client or using >         # a different authenticator >         [$pred(n: notice\_info) = >                 { >                 return n$note == NewSSHConn; >                 }, >          $result = NOTICE\_EMAIL, >          $priority = 1], > }; > > event ssh\_login(server:string, authtype:string, user:string, client:addr) { >     if ( [server, client, user, authtype] !in ssh\_conns ) { >         add ssh\_conns[server, client, user, authtype]; >         NOTICE([$note=NewSSHConn, $src=client, >                 $msg=fmt("New SSH connection %s-\>%s:%s@%s", >                 client, user, authtype, server)]); >     }; > }; I can trigger the error with the following command: ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [February 17, 2009, 9:37pm UTC](https://community.zeek.org/t/broclient-and-notice/1491/2 "2009-02-17T21:37:03Z")
Thanks for reporting this, there's already a ticket for it: [http://tracker.icir.org/bro/ticket/65](http://tracker.icir.org/bro/ticket/65) I've just added a patch to the ticket, which I hope will fix the crash. It will however still report the run-time error. The underlying problem is that the function get\_event\_peer() tries to get information about the peer it received the event from, the connection to that peer however has already terminated so that the information isn't there anymore. That's a race-condition which is generally hard to avoid as Bro's event processing is decoupled from when an event is raised/received. One way to work-around such race conditions is sending explicit ack events that only terminate a connection once received, making sure that all important events have already been processed. bro-client however can't do that. Let me know if the patch works for you (it's against trunk but should also work with 1.4). Robin ---
**Author:** ![Sean\_McCreary](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@Sean\_McCreary](https://community.zeek.org/u/Sean_McCreary)\ **Post date:** [February 19, 2009, 1:21am UTC](https://community.zeek.org/t/broclient-and-notice/1491/3 "2009-02-19T01:21:56Z")
Robin Sommer wrote: ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [February 19, 2009, 7:38pm UTC](https://community.zeek.org/t/broclient-and-notice/1491/4 "2009-02-19T19:38:10Z")
Thanks for testing, I've schedulued it for integration into the next relase. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/broclient-and-notice/1491/5 "2022-05-06T15:38:51Z")