# BroCtl plugin - Hooking into install command (UNCLASSIFIED) **URL:** \ **Category:** Zeek\ **Created:** [April 26, 2016, 7:27am UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123 "2016-04-26T07:27:24Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Knick\_Scott\_E\_CTR\_US](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Knick\_Scott\_E\_CTR\_US](https://community.zeek.org/u/Knick_Scott_E_CTR_US)\ **Post date:** [April 26, 2016, 7:27am UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123/1 "2016-04-26T07:27:24Z")
CLASSIFICATION: UNCLASSIFIED I've developed a custom BroCtl plugin which attempts to hook into the install command before it executes (i.e., I'm overriding cmd\_install\_pre()) so that a configuration defined elsewhere in /usr/local/etc can be read and the various Bro configuration files (e.g., node.cfg, networks.cfg, etc.) can be adjusted as a result. This basically works, but I have noticed that it seems like I have to run broctl install \*twice\* in order to make BroCtl and/or Bro realize the new configuration. Otherwise, Bro crashes and BroCtl tells me to look at the diagnostics using the diag command when I do a broctl start. The actual error messages vary but they all seem to suggest that something in Bro isn't reading in my new configuration as defined in the various Bro configuration files. I have verified that those files are actually updated to what I want prior to running broctl start. Any ideas what might be going on? Am I missing something? ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [April 26, 2016, 2:46pm UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123/2 "2016-04-26T14:46:52Z")
The problem here is that broctl reads the config files when broctl starts up, not when the "install" command is run, so by the time your pre-install plugin runs, the config files have already been read. ---
**Author:** ![Knick\_Scott\_E\_CTR\_US](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Knick\_Scott\_E\_CTR\_US](https://community.zeek.org/u/Knick_Scott_E_CTR_US)\ **Post date:** [April 27, 2016, 6:45am UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123/3 "2016-04-27T06:45:04Z")
---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [April 27, 2016, 7:55pm UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123/4 "2016-04-27T19:55:22Z")
Have you tried a pre-deploy plugin (i.e., cmd\_deploy\_pre)? That might be a better fit for what you're trying to accomplish, unless there's some reason why you would prefer to not use the deploy command. ---
**Author:** ![Knick\_Scott\_E\_CTR\_US](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Knick\_Scott\_E\_CTR\_US](https://community.zeek.org/u/Knick_Scott_E_CTR_US)\ **Post date:** [April 28, 2016, 1:28pm UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123/5 "2016-04-28T13:28:59Z")
CLASSIFICATION: UNCLASSIFIED Thanks for the recommendation! I'll take a look. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/broctl-plugin-hooking-into-install-command-unclassified/4123/6 "2022-05-06T15:43:37Z")