input-framework reporter_error vs reporter_warning events ?

Development
1

While testing other stuff, I realized that if input-framework cannot find a file
its now generating reporter_warning event instead of reporter_error ?

Did "error" changed to "warning" for some reason ? Wasn't previously this a
error condition ?

0.000000 Reporter::WARNING /DATA/feeds/BRO-feeds/WIRED.blocknet.2/Input::READER_ASCII: Init: cannot open /DATA/feeds/BRO-feeds/WIRED.blocknet.2 (empty)

1) Also in what situations input-framework would generate WARNINGS vs ERRORS ?

2) Does warnings means READER_ASCII will try to read file again after some time
or does it just gives up and waits for me to tap into reporter_warning event to
handle the situation ?

Thanks,
Aashish

2

Hi Aashish,

This changed with Bro 2.5.1. To quote NEWS:

- The input framework's Ascii reader is now more resilient. If an input
   is marked to reread a file when it changes and the file didn't exist
   during a check Bro would stop watching the file in previous versions.
   The same could happen with bad data in a line of a file. These
   situations do not cause Bro to stop watching input files anymore. The
   old behavior is available through settings in the Ascii reader.

Johanna

3

Hah! Should have checked change notes more carefully!

No wonder a bunch of pre 2.5.1 scripts never complained :slight_smile: they all were tapping
into event reporter_error. I'll forward port those now.

Thanks Johanna!

Aashish