When the command is running, there are the extract files in desired location. It works pretty well. But I need that filename in the main.zeek. The question was that how can i access the filename in the main.zeek (used in the .sh file).
As I learned from here, packet_source() function could be called in script. But I can not implement it because I just started using it and I’m trying to get used to the script of Zeek.
In my script (main.zeek), after loading script index which contains packet_source() as the built-in function (@load base/bif/zeek.bif.zeek), how can i define a variable and use it (e.g global filename: function packet_source():, is it valid)?
packet_source returns a PacketSource value. If its path value is set Zeek is reading from a PCAP file.
event zeek_init()
{
# Get the current PacketSource.
local source = packet_source();
# If the the `path` field of `PacketSource` is set we
# are reading from an offline PCAP file. Print it.
if ( source?$path )
{
print source$path;
}
}
I’m developing the code in the zeek/base/frameworks/files/main.zeek. In my script, adding loads are done because of the packet_source() and zeek_init().
While other variables can be written to the file, the variable I specified is unfortunately not written and even prevents log files of others from being output. So what am I missing? @Benjamin_Bannier
It’d really help to see a minimal, runnable example so we can iterate on something reproducible.
A few tips:
You should not edit the scripts below scripts/base because doing so will prevent you from shipping your changes independently from the Zeek distribution in a Zeek package. Try writing your code based on your own event handlers instead, just like the main.zeek you’re looking at.
You’re defining filename_source as a variable local to your zeek_init handler, so you cannot have it available in set_info — I suspect you’re either using a global or calling packet_source() again somewhere (which should be fine).
The path member of the PacketSource record is already a string, so you can just say f$info = filename_source$path.
and even prevents log files of others from being output
That’s a red flag — I suspect Zeek exited or reported warnings, perhaps based on grammatical or runtime errors in your script.