input-framework reporter_error vs reporter_warning events ?

While testing other stuff, I realized that if input-framework cannot find a file
its now generating reporter_warning event instead of reporter_error ?

Did "error" changed to "warning" for some reason ? Wasn't previously this a
error condition ?

0.000000 Reporter::WARNING /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init: cannot open /DATA/feeds/BRO-feeds/WIRED.blocknet.2 (empty)

1) Also in what situations input-framework would generate WARNINGS vs ERRORS ?

2) Does warnings means READER_ASCII will try to read file again after some time
or does it just gives up and waits for me to tap into reporter_warning event to
handle the situation ?


Hi Aashish,

This changed with Bro 2.5.1. To quote NEWS:

- The input framework's Ascii reader is now more resilient. If an input
   is marked to reread a file when it changes and the file didn't exist
   during a check Bro would stop watching the file in previous versions.
   The same could happen with bad data in a line of a file. These
   situations do not cause Bro to stop watching input files anymore. The
   old behavior is available through settings in the Ascii reader.


Hah! Should have checked change notes more carefully!

No wonder a bunch of pre 2.5.1 scripts never complained :slight_smile: they all were tapping
into event reporter_error. I'll forward port those now.

Thanks Johanna!