# Notice suppression in beta

**URL:** <https://community.zeek.org/t/notice-suppression-in-beta/2893>\
**Category:** Zeek\
**Created:** [November 7, 2013, 6:10pm UTC](https://community.zeek.org/t/notice-suppression-in-beta/2893 "2013-11-07T18:10:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lou\_RUPPERT](https://avatars.discourse-cdn.com/v4/letter/l/a587f6/32.png) [@Lou\_RUPPERT](https://community.zeek.org/u/Lou_RUPPERT)\
**Post date:** [November 7, 2013, 6:10pm UTC](https://community.zeek.org/t/notice-suppression-in-beta/2893/1 "2013-11-07T18:10:38Z")

</div>

Hey,

I'm still having trouble suppressing SSL notices in 2.2. I have this  
code, which should work:

- --- snip ---  
const safe\_vendor\_netblocks = { 192.168.0.0/16, 10.0.0.0/8, };

function suppress\_ssl\_notice(n: Notice::Info): bool  
{  
&nbsp;&nbsp;&nbsp;&nbsp;# Vendors  
&nbsp;&nbsp;&nbsp;&nbsp;if (n$dst in safe\_vendor\_netblocks)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return T;

&nbsp;&nbsp;&nbsp;&nbsp;return F;  
}

hook Notice::policy(n: Notice::Info) &priority=5  
{  
&nbsp;&nbsp;if ( n$note == SSL::Invalid\_Server\_Cert && suppress\_ssl\_notice(n) )  
&nbsp;&nbsp;&nbsp;&nbsp;break;  
}

- --- snip ---

But still I see notices coming through with IPs in the netblocks  
listed and with a note for SSL::Invalid\_Server\_Cert. Shouldn't a break  
issued from a hook with a greater priority than the default process  
prevent the notice from being logged?

- --  
I prefer encrypted email. Get my key here:  
[http://www.louruppert.com/keys/115DCF62.asc](http://www.louruppert.com/keys/115DCF62.asc)  
PGP Fingerprint: 3261 B9F9 9363 D512 56F8 12DD 127F 4D6A 115D CF62

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [November 7, 2013, 8:34pm UTC](https://community.zeek.org/t/notice-suppression-in-beta/2893/2 "2013-11-07T20:34:26Z")

</div>

There’s a priority 10 notice policy hook that configures some actions to take depending on the value of n$note, and by default it adds the logging action (to be performed later).

So either “break”ing from a hook with priority greater than 10 or “delete n$actions[Notice::ACTION\_LOG]” from one with lower priority should prevent a notice from being logged. The former would also prevent any email/alarm actions associated with the notice type.

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/notice-suppression-in-beta/2893/3 "2022-05-06T15:41:22Z")

</div>