# Problem running Bro in command line

**URL:** <https://community.zeek.org/t/problem-running-bro-in-command-line/1540>\
**Category:** Zeek\
**Created:** [October 8, 2009, 7:28pm UTC](https://community.zeek.org/t/problem-running-bro-in-command-line/1540 "2009-10-08T19:28:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Greg\_Kosinovsky](https://avatars.discourse-cdn.com/v4/letter/g/d07c76/32.png) [@Greg\_Kosinovsky](https://community.zeek.org/u/Greg_Kosinovsky)\
**Post date:** [October 8, 2009, 7:28pm UTC](https://community.zeek.org/t/problem-running-bro-in-command-line/1540/1 "2009-10-08T19:28:59Z")

</div>

I have an application from which I invoke bro with libcap input expected on stdin (using "-r -"). I then pipe pckets to stdin of this process. It works well for small files.

For large files something goes wrong (looks like the pipe going to bro stdin backs up, or something).  
I used to have problems on bro not flusing to stdout, so I used flush\_all() after print statements in my bro script and that seemed to work.  
Is there a similar command to force bro to read data in stdin?

Thank you

Greg Kosinovsky

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [October 9, 2009, 5:00am UTC](https://community.zeek.org/t/problem-running-bro-in-command-line/1540/2 "2009-10-09T05:00:26Z")

</div>

Hmm, that's sounds strange, I wouldn't think Bro can block on stdin  
as long there's data coming in. Is there any chance the problem is  
with the pipe \*writer\*?

Robin

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [October 9, 2009, 5:09am UTC](https://community.zeek.org/t/problem-running-bro-in-command-line/1540/3 "2009-10-09T05:09:47Z")

</div>

When reporting Bro problems like this, it's important to say under what  
system you're running and what version of Bro you're using.

> For large files something goes wrong (looks like the pipe going to  
> bro stdin backs up, or something).

We feed Bro very large files via -r and haven't encountered this problem.

The first step is to attach a debugger (after configuring with --enable-debug  
and rebuilding) to see whether it's indeed blocked waiting for input, or  
instead stuck doing something else.

> I used to have problems on bro not flusing to stdout, so I used  
> flush\_all() after print statements in my bro script and that seemed to work.  
> Is there a similar command to force bro to read data in stdin?

No, and it definitely shouldn't be needed.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/problem-running-bro-in-command-line/1540/4 "2022-05-06T15:38:57Z")

</div>