Re-reading data in the input framework

Zeek
1

Hi,

I want to test if a table that holds data from an input source file with the automatic refresh mode “REREAD” reflects changes applied to the source file. This is what my file looks like

-----------------------------config.bro---------------------------------
module Config;

type Idx: record {
parameter: string;
};

type Val: record {
value: string;
};

export {
global table_config: table[string] of Val;
}

global config_filename = “/usr/local/bro/share/bro/site/botflex/config.txt”;

event bro_init() &priority=20
{
Input::add_table([$source=config_filename, $name=“config_stream”, $idx=Idx,
$val=Val, $destination=table_config, $mode=Input::REREAD]);
Input::remove(“config_stream”);
}

event Input::update_finished(name: string, source: string)
{

now all data is in the table

print “Updated”;
print table_config;
}

event bro_done()
{
print “Ending”;
print table_config;
}

2

Hello,

my tutorial probably was not very clear on this point. The line – Input::remove(“config_stream”); – removes the input stream after the current input stream operation has been executed. Thus, in your script the input stream is closed right after the file has been read for the first time. After the stream is closed, changes to the input file will not be reflected in Bro, no matter the mode you chose.

Removing that single line should fix the problem :slight_smile:

Johanna

3

Thanks. I thought it creates a new stream for each read/remove. From your answer, it appears that each source with REREAD mode gets a dedicated stream that exists as long as Bro runs.

Regards,

4

Exactly. The stream exists for the whole duration and the reader for the stream runs in a thread and checks for changes of the file.

Johanna