smb log add new field

Zeek
1

Hi,
I need to add new filed in smb_mapping.log and and smb_files.log, i tried below code
but its giving error

@load base/protocols/smb

module SMB;

#redef LogAscii::use_json = T;
export
{

}
redef record SMB::TreeInfo += {
orig_country_code: string &log &optional;

};

nternal warning in ././trybro.bro, line 10: Can’t document redef of SMB::TreeInfo, identifier lookup failed
internal warning in ././trybro.bro, line 11: Can’t document record field orig_country_code, unknown record: SMB::TreeInfo
error in ././trybro.bro, line 10: unknown identifier (SMB::TreeInfo)

Regards,
Sunu

2

This is the problem. Because we chose to leave the SMB scripts out of the default base load in 2.5 (they’ll be there for 2.6!) you need to load them first. Replace the line you used above with this…

@load policy/protocols/smb

.Seth