Hui Lin_NOTICE function redefinition error

Zeek
1

Hi,

When I load notice and use NOTICE function in my script, there is a error message

error in /usr/local/bro/share/bro/base/frameworks/notice/./main.bro, line 569: already defined (NOTICE)

According to the error message, I found that two NOTICE functions are defined in this /notice/main.bro and also in notice.bro. So what is the correct way to use NOTICE function?

Best,

Hui

2

You're going to need to show a snippet of code that causes this error. :slight_smile:

  .Seth

3

Well this is what my codes look like. I just call NOTICE function within one of my event handler.

@load notice
@load /home/hugo/experiment/dnp3/policy/dnp3headers_sl.bro

redef enum Notice += {
CriState, # notice for my semantic signature matching; critical state
};

…

event dnp3_crob(c: connection, is_orig: bool, control_code: count, count8: count, on_time: count, off_time: count, status_code: count)
{
…
NOTICE([$note=CriState,
$msg=“Test CriState is recoreded”,
$conn=c]);
…
}

4

Being stupid again.

It is again the version mix up of the policy files. Discussed this with Robin before. I delete many old script and now it seems to be fine now.

Best,

Hui

5

Are you working with something close to 2.0? In 2.0 that enum is named Notice::Type. Where you call the NOTICE function looks ok.

  .Seth

6

Yes. My bad. I still have some 1.5 scripts left there. I delete them and it is working fine now.