Error: value used but not set (bloomfilter_basic_init)

Zeek
1

All,

This is my first time using the mailing list so please let me know if I need to follow a certain format when asking questions.

We are trying to set up a Bro 2.3 development server but whenever we run ‘broctl check’ our SMTP script throws the following error:

Value used but not set (bloomfilter_basic_init)

This is the offending line:

global mail_links = bloomfilter_basic_init(0.00000001, 10000000);

We got the script from GitHub. Looks nearly identical to this:

https://github.com/initconf/smtp-analysis/blob/master/smtp-embedded-url-bloom.bro

It’s worth noting that the script runs with no issues on a previous version of Bro.

Any help would be appreciated!!

2

I just tested this script with latest bro-2.3.1 and script seems to be running fine.
I think there is some other issue which is causing bro to incorrectly point to mail_links as error location.

I might be wrong but "value used but not set" shouldn't cause bro to fail.

Could you do the following:

broctl install; broctl start ;

(and if bro fails )

paste me the error

or output of: broctl diag

Aashish

3

This is my first time using the mailing list so please let me know if I need to follow a certain format when asking questions.

Hi. This is perfectly fine. :slight_smile:

global mail_links = bloomfilter_basic_init(0.00000001, 10000000);

We got the script from GitHub. Looks nearly identical to this:
https://github.com/initconf/smtp-analysis/blob/master/smtp-embedded-url-bloom.bro

Yeah, I noticed that issue with that script as well. There is a thread from a while ago where I promised to get that script heavily updated and haven't finished it yet.

If you only declare the type and don't initialize it there then do the call to bloomfilter_basic_init in a bro_init handler it should work.

So, while I was in the middle of writing this email, I went ahead and finished the smtp-url.bro script. This is very similar to Aashish's smtp-embedded-url-bloom.bro script but has been very lightly tested. I'd appreciate feedback from anyone that decides to run it. :slight_smile:

I put the script into the "official" external Bro scripts repository:
  https://github.com/bro/bro-scripts/blob/master/smtp-url.bro

  .Seth