# how to add new event to Bro **URL:** \ **Category:** Zeek\ **Created:** [April 6, 2005, 9:16pm UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727 "2005-04-06T21:16:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\ **Post date:** [April 6, 2005, 9:16pm UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/1 "2005-04-06T21:16:26Z")
Hi all,    I am new in Bro. I want to add new events to Bro. These events would occur when some statistical parameters cross multiple sessions to an internal host/network exceed their thresholds. An example event would be that the number of connections made from external hosts to an monitored internal host exceeds 100 in last two seconds. Another example event would be that the number of Rejected connection requests to my internal network exceeds 200 in last two minutes. Any one knows how to create such events?    Another problem I met when I tried to run Bro (./bro.rc --start) in Fedora 3. Success message was displayed on the screen. But when I check the status, it is not running. After I tried to run Bro again, the following error message appears: ---
**Author:** ![Joncarlo\_Ruggieri](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Joncarlo\_Ruggieri](https://community.zeek.org/u/Joncarlo_Ruggieri)\ **Post date:** [April 6, 2005, 9:37pm UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/2 "2005-04-06T21:37:17Z")
Hi, I'm running Bro on Red Hat Enteprise Linux 4. I too had the error below regarding a bogus '-' The culprit was bro.rc. In this subroutine:    pidisrunning() {            else                    # the rest of \*NIX                    \_running\_pid=`ps -o "pid,command" -ax | grep    "${\_pid}.\*${\_cmd\_line}" | grep -v "grep ${\_pid}.\*${\_cmd\_line}"`            fi remove the "-" from "-ax" for the "ps" command. The revised line would be:                    \_running\_pid=`ps -o "pid,command" ax | grep Hope that helps! Joncarlo Ruggieri University of CA, Davis ---
**Author:** ![Aashish\_Sharma](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aashish\_Sharma](https://community.zeek.org/u/Aashish_Sharma)\ **Post date:** [April 6, 2005, 9:49pm UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/3 "2005-04-06T21:49:10Z")
Your second question : I think due to interdependency of signature related policy files they all need to be loaded or (not loaded) together. You need to define use\_signatures variable in ../policy/brolite.bro as T (true) for enabling all the signature related policy files to be loaded. Aashish Sharma ---
**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\ **Post date:** [April 7, 2005, 1:17am UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/4 "2005-04-07T01:17:05Z")
Thanks. that helps. Bing Quoting Joncarlo Ruggieri \: ---
**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\ **Post date:** [April 7, 2005, 1:23am UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/5 "2005-04-07T01:23:49Z")
Hi Aashish,    Thanks. That helps. Any thought about my first question? Bing Quoting Aashish Sharma \: ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [April 8, 2005, 1:28am UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/6 "2005-04-08T01:28:02Z")
Hi Bing, > Hi all, >    I am new in Bro. I want to add new events to Bro. These events would occur > when some statistical parameters cross multiple sessions to an internal > host/network exceed their thresholds. An example event would be that the number > of connections made from external hosts to an monitored internal host exceeds > 100 in last two seconds. Another example event would be that the number of > Rejected connection requests to my internal network exceeds 200 in last two > minutes. Any one knows how to create such events? it all depends on what kinds of events trigger updates to your statistical parameters, and whether those elementary events already exist or not. Generally a good way to find existing events is by looking at src/event.bif, which lists all events the core can trigger. If you find suitable building blocks in there, you can start with a new policy script that maintains state through the event handlers for event types you're interested in. If you cannot find anything suitable (which, at least for network-based events, is rather unlikely), you might have to extend the core to support new events to be handled by your policy scripts. In your case, the event types connection\_attempt() and connection\_rejected() sound ideal. In their respective handlers, you can maintain connection state in a number of tables to achieve what you want. When you notice that the rate limits you defined are exceeded, you can trigger an event "manually" using the event() statement, or just perform the corresponding action directly in the state-maintaining code. Have a look at scan.bro for an example of something that is similar what you want; also check out this thread in the archives:   [http://mailman.icsi.berkeley.edu/pipermail/bro/2005-February/001774.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2005-February/001774.html) Hope this helps. Cheers, Christian. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/how-to-add-new-event-to-bro/727/7 "2022-05-06T15:37:25Z")