I have an application from which I invoke bro with libcap input expected on stdin (using "-r -"). I then pipe pckets to stdin of this process. It works well for small files.
For large files something goes wrong (looks like the pipe going to bro stdin backs up, or something).
I used to have problems on bro not flusing to stdout, so I used flush_all() after print statements in my bro script and that seemed to work.
Is there a similar command to force bro to read data in stdin?
Hmm, that's sounds strange, I wouldn't think Bro can block on stdin
as long there's data coming in. Is there any chance the problem is
with the pipe *writer*?
When reporting Bro problems like this, it's important to say under what
system you're running and what version of Bro you're using.
For large files something goes wrong (looks like the pipe going to
bro stdin backs up, or something).
We feed Bro very large files via -r and haven't encountered this problem.
The first step is to attach a debugger (after configuring with --enable-debug
and rebuilding) to see whether it's indeed blocked waiting for input, or
instead stuck doing something else.
I used to have problems on bro not flusing to stdout, so I used
flush_all() after print statements in my bro script and that seemed to work.
Is there a similar command to force bro to read data in stdin?