Event namespaces

Zeek
1

At https://docs.zeek.org/en/stable/frameworks/broker.html#a-reminder-about-events-and-module-namespaces, following a code sample, there is the statement:

This code runs without errors, however, the local my_event handler will never be called and also not any remote handlers either, even if Broker::auto_publish was used elsewhere for it.

My tests have not supported that assertion: the event handler is invoked - even via auto_publish. If it is so, how/when exactly would it manifest? Are there other factors that might cause it to be true in some cases? (Say, the same event name in a different namespace?)

Just trying to figure out how careful I need to be of namespace issues. My tests have generally shown that if you get the namespace of some script element wrong, the script parsing stage gives you an ‘undefined’ right out of the gate.

Thanks,
Jeff

2

Hhmm… I get the expected non-working behavior:

====== TEST 1 ======

cat test.zeek

module MyModule;

export {
global my_event: event();
}

event my_event()
{
print “got my event”;
}

event zeek_init()
{
event my_event();
schedule 10sec { my_event() };
}

zeek -i eth0 test.zeek

listening on eth0

(nothing else)

======= TEST 2 =======

cat test2.zeek

module MyModule;

export {
global my_event: event();
}

event my_event()
{
print “got my event”;
}

event zeek_init()
{
event MyModule::my_event();
schedule 10sec { MyModule::my_event() };
}

zeek -i eth0 test2.zeek

listening on eth0

got my event
got my event

3

Take a look at these: https://github.com/zeek/zeek/issues/163 & https://bro-tracker.atlassian.net/browse/BIT-984

I’ve run into this issue, and my best practice is to use fully scoped event names, which is the recommended workaround.

Jim

4

Ah. Thanks, Jim.

That’s what I wanted to understand: From your second link, it’s clear that the “global” declaration on the event is what causes the issue. If you simply define an event (without global) and use it within the same script file, there seems to be no problem.

Cheers,
Jeff