question about plugin init

Zeek
1

Hi,
I am trying write a bro analyzer plugin. My directory structure for my plugin is shown below.
My scripts load.bro loads my init.bro and analyzer/test/test.bro. My test.bro file registers
for ‘event bro_init’ in which I am registering for some ports. Even though I can see both my bro
scripts are loaded in loaded_scripts.log, my bro_init event is never triggered and hence I never
register for my ports. I can it’s not being invoked because, my print in that function don’t show
and up and it doesn’t complain even if I put syntactically incorrect code in my bro_init function.
Could someone shed some light on why my bro_init event is not getting triggered or if I am
doing something wrong. Thanks.

Dk.

– bro_plugin
– lib

– analyzer-test.linux-x86_64.so
-- bif -- __load__.bro -- events.bif.bro – test.bif.bro
-- scripts -- __load__.bro -- analyzer – test
– load.bro
-- test.bro – init.bro

2

could some please comment on my query.

Another related question, can two protocol analyzer modules register for the same dpd signature? thanks.

3

Could someone shed some light on why my bro_init event is not getting
triggered or if I am doing something wrong.

This would be easiest to debug with the actual code. Can you send me a
tar file of your plugin off-list?

Robin

4

Yes, if memory serves me right, adding two separate 'enable "..."'
statements to a signature should work fine.

Robin