- Exec::run when reading a pcap

Zeek
1

Hi,

I’m having troubles running a simple script on bro 2.5 reading a pcap file:

@load base/utils/exec

#redef exit_only_after_terminate=T;

event bro_init()
{
print “Hello, World!”;

local t=“echo 123 ; echo 456”;
local cmd=Exec::Command($cmd=t);
when (local res = Exec::run(cmd))
{
print “start !”;
print res$stdout;
print “finish !”;
}

}

the exec commands runs successfully on try.bro.org, but prints nothing in the “when” bracket when running on local bro (v2.5).

Is there a simple way of running a command with arguments and getting its return value right away ?

system(“ls”); works great but by design I can’t get its results.

any thoughts ?

Thanks
B

2

Uncomment this and it works. Bro can't do anything by blocking script execution but if there is no input or you haven't explicitly told it to avoid shutting down then it will shutdown when there is no more input.

   .Seth

3

Hi Seth,

after uncommenting this line, bro is stuck and won’t terminate on its own…

4

Add this line immediately after the 'print "finish !";' line:

terminate();