# Debugging policy
**URL:** https://community.zeek.org/t/debugging-policy/1352
**Category:** Zeek
**Created:** [June 23, 2008, 4:14pm UTC](https://community.zeek.org/t/debugging-policy/1352 "2008-06-23T16:14:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Greg\_Lindon](https://community.zeek.org/u/Greg_Lindon)
#### Post date: [June 23, 2008, 4:14pm UTC](https://community.zeek.org/t/debugging-policy/1352/1 "2008-06-23T16:14:37Z")
OK, so I'm still having problems ☹
I have a small pcap (1.6 MB) with a telnet login to test with, but it
is taking forever for bro to even get to the point of giving me an
error with my policy. I am running bro 1.3.2 with:
bro -r test.pcap -t tracefile.txt local.clear-passwords.bro
which takes around 30 minutes(!?!) to give me a fairly unhelpful error
about my policy. Why is it so slow? In tracefile.txt I only get
stuff from bro.init about opening log files, and in the terminal I
only get the usual stuff from scan.bro about the DNS root servers.
Why is scan.bro even being run? As far as I can see, the policy files
that I am including (see attached) don't depend on it?
I thought the box I was using might be overly taxed with other
software, but I installed it somewhere else with the same slow result.
Bro doesn't even show up in the first page of "top" processes. Is
there some sort of nice-ing going on that I can turn off? Can I tell
it to consume more system resources?
The error bro gives is "parse error at or near event", the line number
is for the "event account\_tried" declaration. I'm guessing that I
have a syntax error in my password array, but this process is making
debugging slow.
Thoughts?
Greg
[bro\_clear\_pass\_policy.txt](https://community.zeek.org/uploads/short-url/28MAmW7ITpoxIeU9RbSxSYEF6W9.txt) (1.22 KB)
---
### Author:  [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [June 23, 2008, 4:46pm UTC](https://community.zeek.org/t/debugging-policy/1352/2 "2008-06-23T16:46:13Z")
> bro -r test.pcap -t tracefile.txt local.clear-passwords.bro
>
> which takes around 30 minutes(!?!) to give me a fairly unhelpful error
> about my policy.
> ...
> Bro doesn't even show up in the first page of "top" processes.
Try setting the environment variable BRO\_DNS\_FAKE to turn off DNS lookups.
Most likely it's simply sitting in a series of long DNS timeouts.
> The error bro gives is "parse error at or near event", the line number
> is for the "event account\_tried" declaration. I'm guessing that I
> have a syntax error in my password array, but this process is making
> debugging slow.
Yes, you don't have a ';' at the end of "global known\_pass = { ... }".
Vern
---
### Author:  [@Greg\_Lindon](https://community.zeek.org/u/Greg_Lindon)
#### Post date: [June 23, 2008, 6:06pm UTC](https://community.zeek.org/t/debugging-policy/1352/3 "2008-06-23T18:06:34Z")
Thanks. Seems painfully obvious now 🙂
Greg
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/debugging-policy/1352/4 "2022-05-06T15:38:35Z")