# Retrieve modbus error code in Zeek event

**URL:** <https://community.zeek.org/t/retrieve-modbus-error-code-in-zeek-event/6815>\
**Category:** Development\
**Tags:** scripting\
**Created:** [November 28, 2022, 5:04pm UTC](https://community.zeek.org/t/retrieve-modbus-error-code-in-zeek-event/6815 "2022-11-28T17:04:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leviath](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@Leviath](https://community.zeek.org/u/Leviath)\
**Post date:** [November 28, 2022, 5:04pm UTC](https://community.zeek.org/t/retrieve-modbus-error-code-in-zeek-event/6815/1 "2022-11-28T17:04:29Z")

</div>

Hello,

I am trying to write a script to log events only when a controller has sent a modbus request to a robot with no response.

At the moment, I am able to capture the response of a read\_holding\_registers request from the controller.

I would only like to log the event when the robot is not accessible for any reason.

Based on what I’ve read on the [modbus documentation](https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf), the robot should issue a timeout response, I think that generating logs based on the Timeout error code is a good start, but I can’t figure out how to do it.

my event code for the response currently look like this :

```auto
event modbus_read_holding_registers_response(c: connection,
                                            headers: ModbusHeaders,
                                            start_address: count,
                                            quantity: count) {

    local read_holding_request: Modbus_Detailed;
    read_holding_request$ts = network_time();
    read_holding_request$uid = c$uid;
    read_holding_request$id = c$id;

    read_holding_request$unit_id = headers$uid;
    read_holding_request$func = Modbus::function_codes[headers$function_code];
    read_holding_request$network_direction = request_str_g;
    read_holding_request$address = start_address;
    read_holding_request$quantity = quantity;

    Log::write(LOG_DETAILED, read_holding_response;
}

```

How can I modify the event to make it work with my use case ?

Thank you for your help

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [December 1, 2022, 4:04pm UTC](https://community.zeek.org/t/retrieve-modbus-error-code-in-zeek-event/6815/2 "2022-12-01T16:04:45Z")

</div>

> How can I modify the event to make it work with my use case ?

It seems you have made progress since you asked this. Lets continue discussing in your follow-up:

> [@Check if request has response in Zeek script](https://community.zeek.org/t/check-if-request-has-response-in-zeek-script/6825):
>
> Good Morning, I have a Zeek machine generating logs on a Modbus traffic. My logs look like this : 1342774501.072580 32 10.2.2.2 51411 10.2.2.3 502 255 READ\_HOLDING\_REGISTERS request 1342774501.087014 32 10.2.2.2 51411 10.2.2.3 502 255 READ\_HOLDING\_REGISTERS response ‘tid’ is the transaction id to identify a request/response couple. I want to know if a robot hasn’t responded to the Controller by logging only requests that did not…