# Notifications from Local.bro **URL:** \ **Category:** Zeek\ **Created:** [May 19, 2014, 10:58pm UTC](https://community.zeek.org/t/notifications-from-local-bro/3124 "2014-05-19T22:58:50Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Damon\_Rouse](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Damon\_Rouse](https://community.zeek.org/u/Damon_Rouse)\ **Post date:** [May 19, 2014, 10:58pm UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/1 "2014-05-19T22:58:50Z")
Hi Everyone I’m pretty new to BRO and have a quick question about setting up alerts from Bro. Inside my Local.bro file I have the following what’s below (which works great). If I uncomment the emailed\_types redef, Bro errors out after running the following sudo broctl install && sudo broctl restart. The error is: manager terminated immediately after starting; check output with “diag” Can you only have one redef statement in the local.bro file? Or did I make a mistake somewhere? hook Notice::policy(n: Notice::Info) { add n$actions[Notice::ACTION\_EMAIL]; } # redef Notice::emailed\_types += { HTTP::Incorrect\_File\_Type, SSH::Interesting\_Hostname\_Login, HTTP::Malware\_Hash\_Registry\_Match, APT1::Domain\_Hit, APT1::Certificate\_Hit, APT1::File\_MD5\_Hit, }; redef Notice::ignored\_types += { SSL::Invalid\_Server\_Cert }; Thanks! ---
**Author:** ![Jon\_Schipp](https://avatars.discourse-cdn.com/v4/letter/j/8797f3/32.png) [@Jon\_Schipp](https://community.zeek.org/u/Jon_Schipp)\ **Post date:** [May 20, 2014, 12:28am UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/2 "2014-05-20T00:28:01Z")
Just to be sure, are you uncommenting the entire emailed\_types redefinition? You have a comment character at the beginning of the definition in your output, “# redef Notice::emailed\_types +=”. ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [May 20, 2014, 12:43am UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/3 "2014-05-20T00:43:41Z")
More than one redef is fine. After the failed start, if you do `broctl diag`, it may give more of a clue as to what’s wrong. Can you share the output of that if you need more help interpreting the error? - Jon ---
**Author:** ![Damon\_Rouse](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Damon\_Rouse](https://community.zeek.org/u/Damon_Rouse)\ **Post date:** [May 20, 2014, 2:34am UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/4 "2014-05-20T02:34:59Z")
Yes, I’m removing that last comment character. I’ll run and post the diag later tonight. Thanks ---
**Author:** ![Damon\_Rouse](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Damon\_Rouse](https://community.zeek.org/u/Damon_Rouse)\ **Post date:** [May 20, 2014, 5:39am UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/5 "2014-05-20T05:39:37Z")
Here’s the output of the diag after I uncommented redef and restarted BRO. Not sure why it’s saying the HTTP::Incorrect\_File\_Type is an unknown identifier. Thanks for your help Damon sudo broctl diag waiting for lock ..... ok [manager] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== stderr.log error in /nsm/bro/spool/installed-scripts-do-not-touch/site/local.bro, line 99: unknown identifier HTTP::Incorrect\_File\_Type, at or near "HTTP::Incorrect\_File\_Type" ==== stdout.log unlimited unlimited unlimited ==== .cmdline -U .status -p broctl -p broctl-live -p local -p manager local.bro broctl base/frameworks/cluster local-manager.bro broctl/auto ==== .env\_vars PATH=/opt/bro/bin:/opt/bro/share/broctl/scripts:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin BROPATH=/nsm/bro/spool/installed-scripts-do-not-touch/site::/nsm/bro/spool/installed-scripts-do-not-touch/auto:/opt/bro/share/bro:/opt/bro/share/bro/policy:/opt/bro/share/bro/site CLUSTER\_NODE=manager ==== .status TERMINATED [atexit] ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [proxy] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-1] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-2] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-3] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-4] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-5] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-6] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-7] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth1-8] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-1] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-2] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-3] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-4] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-5] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-6] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-7] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log [essorgso-eth2-8] Bro 2.2 Linux 3.2.0-61-generic ==== No reporter.log ==== No stderr.log ==== No stdout.log ==== No .cmdline ==== No .env\_vars ==== No .status ==== No prof.log ==== No packet\_filter.log ==== No loaded\_scripts.log ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [May 20, 2014, 5:57am UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/6 "2014-05-20T05:57:25Z")
HTTP::Incorrect\_File\_Type was removed with an overhaul of the files framework even before 2.2, if I read the git commit log correctly. So - you probably just want to remove that one from your script. Johanna ---
**Author:** ![Damon\_Rouse](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Damon\_Rouse](https://community.zeek.org/u/Damon_Rouse)\ **Post date:** [May 20, 2014, 6:15am UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/7 "2014-05-20T06:15:29Z")
Thanks Johanna I’m all good now…Looks like this one was removed too (got the same error): HTTP::Malware\_Hash\_Registry\_Match Is there a link to all the notice types somewhere for a beginner like me? Thanks Damon ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 20, 2014, 12:17pm UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/8 "2014-05-20T12:17:37Z")
> I’m all good now…Looks like this one was removed too (got the same error): HTTP::Malware\_Hash\_Registry\_Match It was renamed because it's now generic across any file protocol. TeamCymruMalwareHashRegistry::Match > Is there a link to all the notice types somewhere for a beginner like me? Yes. [http://www.bro.org/sphinx/bro-noticeindex.html](http://www.bro.org/sphinx/bro-noticeindex.html)   .Seth ---
**Author:** ![Damon\_Rouse](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Damon\_Rouse](https://community.zeek.org/u/Damon_Rouse)\ **Post date:** [May 20, 2014, 3:42pm UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/9 "2014-05-20T15:42:36Z")
Thanks for the help everyone, much appreciated! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/notifications-from-local-bro/3124/10 "2022-05-06T15:41:48Z")