# Plugin doesn't seem te get instantiated **URL:** \ **Category:** Zeek\ **Created:** [August 21, 2015, 7:31pm UTC](https://community.zeek.org/t/plugin-doesnt-seem-te-get-instantiated/3782 "2015-08-21T19:31:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Bas\_Vermeulen](https://avatars.discourse-cdn.com/v4/letter/b/e47774/32.png) [@Bas\_Vermeulen](https://community.zeek.org/u/Bas_Vermeulen)\ **Post date:** [August 21, 2015, 7:31pm UTC](https://community.zeek.org/t/plugin-doesnt-seem-te-get-instantiated/3782/1 "2015-08-21T19:31:00Z")
Hi all, I want to create my own bro plugin but I’m stuck in the playing-around phase. Below is my current code and information about my system. I know packet counts are available in the normal logs, this is just my hello world for bro. The problem is that while bro seems to recognize that there is a plugin, it doesn’t seem to instantiate the analyzer when is is processing a pcap. I’ve tried to activate it using the environment variables, the Available function and the EnableHook. I need to process all connections so I can’t use port numbers or signatures. The only output the plugin creates is ‘hello world!’ from the plugin.cc If the Analyzer gets instantiated, I would expect more output. Could someone please help me? Bas Plugin.cc: ---
**Author:** ![Bas\_Vermeulen](https://avatars.discourse-cdn.com/v4/letter/b/e47774/32.png) [@Bas\_Vermeulen](https://community.zeek.org/u/Bas_Vermeulen)\ **Post date:** [August 23, 2015, 3:40pm UTC](https://community.zeek.org/t/plugin-doesnt-seem-te-get-instantiated/3782/2 "2015-08-23T15:40:01Z")
Hi, In order to find the reason that my plugin isn’t doing anything, I have recompiled with --enable-debug and I run with bro -B plugins. The debug.log now contains 0.000000/1440343663.376984 [plugins] Found plugin mynamespace::myplugin in /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin 0.000000/1440343663.383816 [plugins] Activating plugin mynamespace::myplugin 0.000000/1440343663.383855 [plugins] Adding /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin/scripts to BROPATH 0.000000/1440343663.383892 [plugins] Loading /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin/scripts/ **preload**.bro 0.000000/1440343663.383908 [plugins] Loading /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin/lib/bif/ **load**.bro 0.000000/1440343663.383921 [plugins] Loading /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin/scripts/ **load**.bro 0.000000/1440343663.383932 [plugins] Searching for shared libraries /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin//lib/\*.linux-x86\_64.so 0.000000/1440343663.384400 [plugins] Registering component PluginAnalyzer (tag 68/0) 0.000000/1440343663.384527 [plugins] Loaded /usr/local/bro/lib/bro/plugins/mynamespace\_myplugin//lib/mynamespace-myplugin.linux-x86\_64.so I also added the Available() function to Plugin.h. Is this all that is required? The plugin still doesn’t do anything… Any hints? Or does anyone have an example non-built-in plugin that work on all connections regardless of ports and signatures? Best regards, Bas ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 24, 2015, 3:57pm UTC](https://community.zeek.org/t/plugin-doesnt-seem-te-get-instantiated/3782/3 "2015-08-24T15:57:54Z")
Sounds like you're suspecting the right thing already: the analyzer needs to be explicitly activated for all connections it's supposed to look at, it's not going to receive everything automatically. There there 4 ways to activate an analyzer: (1) by port, (2) by signature, (3) in script-land for a future connection, and (4) with recent git master you can write a C++ hook function that gets called once at the beginning of each connection when the default analyzer setup has been determined; that C++ function can then add the customer analyzer at that point as well. The interface for (1)-(3) is documented here [https://www.bro.org/sphinx/scripts/base/frameworks/analyzer/main.bro.html](https://www.bro.org/sphinx/scripts/base/frameworks/analyzer/main.bro.html). For (4), this is the merge commit (not further documented yet). Robin ---
**Author:** ![Bas\_Vermeulen](https://avatars.discourse-cdn.com/v4/letter/b/e47774/32.png) [@Bas\_Vermeulen](https://community.zeek.org/u/Bas_Vermeulen)\ **Post date:** [August 24, 2015, 8:15pm UTC](https://community.zeek.org/t/plugin-doesnt-seem-te-get-instantiated/3782/4 "2015-08-24T20:15:50Z")
Thanks! I still have a lot of work to do, but now at least my UpdateConnVal is being called, so there is progress 🙂 You made my day! For other people that want to create a dynamic plugin that is invoked for all connections (option 4), this is the progress so far: In my Plugin.cc I added: void HookSetupAnalyzerTree(Connection \*conn) { ::analyzer::mynamespace\_myplugin::PluginAnalyzer::Instantiate(conn); } And in my PluginAnalyzer.cc I now have: PluginAnalyzer::PluginAnalyzer(Connection\* c) : tcp::TCP\_ApplicationAnalyzer(“TEST”, c) { TCP()-\>AddChildAnalyzer(this); // this line took me quite a while 😉 } > Is this all that is required? The plugin still doesn’t do anything… > Any hints? Or does anyone have an example non-built-in plugin that > work on all connections regardless of ports and signatures? Sounds like you’re suspecting the right thing already: the analyzer needs to be explicitly activated for all connections it’s supposed to look at, it’s not going to receive everything automatically. There there 4 ways to activate an analyzer: (1) by port, (2) by signature, (3) in script-land for a future connection, and (4) with recent git master you can write a C++ hook function that gets called once at the beginning of each connection when the default analyzer setup has been determined; that C++ function can then add the customer analyzer at that point as well. The interface for (1)-(3) is documented here [https://www.bro.org/sphinx/scripts/base/frameworks/analyzer/main.bro.html](https://www.bro.org/sphinx/scripts/base/frameworks/analyzer/main.bro.html). For (4), this is the merge commit (not further documented yet). Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/plugin-doesnt-seem-te-get-instantiated/3782/5 "2022-05-06T15:43:00Z")