Hui Lin_NOTICE function redefinition error


When I load notice and use NOTICE function in my script, there is a error message

error in /usr/local/bro/share/bro/base/frameworks/notice/./main.bro, line 569: already defined (NOTICE)

According to the error message, I found that two NOTICE functions are defined in this /notice/main.bro and also in notice.bro. So what is the correct way to use NOTICE function?



You're going to need to show a snippet of code that causes this error. :slight_smile:


Well this is what my codes look like. I just call NOTICE function within one of my event handler.

@load notice
@load /home/hugo/experiment/dnp3/policy/dnp3headers_sl.bro

redef enum Notice += {
CriState, # notice for my semantic signature matching; critical state

event dnp3_crob(c: connection, is_orig: bool, control_code: count, count8: count, on_time: count, off_time: count, status_code: count)

$msg=“Test CriState is recoreded”,


Being stupid again.

It is again the version mix up of the policy files. Discussed this with Robin before. I delete many old script and now it seems to be fine now.



Are you working with something close to 2.0? In 2.0 that enum is named Notice::Type. Where you call the NOTICE function looks ok.


Yes. My bad. I still have some 1.5 scripts left there. I delete them and it is working fine now.