# software.log

**URL:** <https://community.zeek.org/t/software-log/2924>\
**Category:** Zeek\
**Created:** [December 4, 2013, 4:12pm UTC](https://community.zeek.org/t/software-log/2924 "2013-12-04T16:12:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)\
**Post date:** [December 4, 2013, 4:12pm UTC](https://community.zeek.org/t/software-log/2924/1 "2013-12-04T16:12:25Z")

</div>

Here is what I have so far. It is working but I don’t know if it is written correctly.

@load base/frameworks/notice

@load base/frameworks/software

module OLD\_JAVA;

module HTTP;

export {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;redef enum Notice::Type += {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OLD\_JAVA::Java\_seen,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;};

}

event http\_header(c: connection, is\_orig: bool, name: string, value: string) &priority=2

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( Software::found(c$id, [$unparsed\_version="Java/1.7.0\_40", $host=c$id$orig\_h]));

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NOTICE([$note=OLD\_JAVA::Java\_seen, $msg=fmt("Old Java Seen")]);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\
**Post date:** [December 4, 2013, 4:43pm UTC](https://community.zeek.org/t/software-log/2924/2 "2013-12-04T16:43:49Z")

</div>

You want to add $conn=c to the notice, otherwise it won't contain the  
address information.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/software-log/2924/3 "2022-05-06T15:41:26Z")

</div>