# Syntax error in policy

**URL:** <https://community.zeek.org/t/syntax-error-in-policy/469>\
**Category:** Zeek\
**Created:** [March 2, 2004, 4:23pm UTC](https://community.zeek.org/t/syntax-error-in-policy/469 "2004-03-02T16:23:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_M\_Duart](https://avatars.discourse-cdn.com/v4/letter/j/8e8cbc/32.png) [@Jose\_M\_Duart](https://community.zeek.org/u/Jose_M_Duart)\
**Post date:** [March 2, 2004, 4:23pm UTC](https://community.zeek.org/t/syntax-error-in-policy/469/1 "2004-03-02T16:23:31Z")

</div>

Hello all,

i'm trying to use Bro as a prelude sensor. There is a patch for Bro 8a20 and i  
adapted the changes on the source to Bro8a70. Bro compiled fine but there is a  
problem with when i try to execute it, fails with this syntax error:

# bro -i eth0 ./policy/prelude.bro  
./policy/prelude.bro, line 50: error: syntax error, at or near "log\_prelude"

The affected lines are:

47: local msg = a ?$ sub ? fmt("msg: %s -- sub: %s", a$ msg, a$ sub) : a$ msg;  
48: local log\_msg = fmt("alert: %s -- %s", msg, addl);

50: log\_prelude( ip\_src, port\_src, ip\_dst, port\_dst, proto, log\_msg ) ;  
51: } # end of function

This policy file worked fine with versions 8a20 and 8a34. Any ideas?  
If anyone is interested in the full modified source, i put it in

[http://pikachute.uv.es/elas/bro-prelude.tgz](http://pikachute.uv.es/elas/bro-prelude.tgz)

Thanks in advance  
Jose M Duart

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [March 3, 2004, 9:46am UTC](https://community.zeek.org/t/syntax-error-in-policy/469/2 "2004-03-03T09:46:38Z")

</div>

"log\_prelude" seems to be a new keyword. In parse.in the token  
TOK\_LOG\_PRELUDE is defined, but it's not contained in any grammar  
rule. Is it possible that there's a part of the patch missing?

Robin

---

<div class="post-metadata">

**Author:** ![Jose\_M\_Duart](https://avatars.discourse-cdn.com/v4/letter/j/8e8cbc/32.png) [@Jose\_M\_Duart](https://community.zeek.org/u/Jose_M_Duart)\
**Post date:** [March 3, 2004, 9:02pm UTC](https://community.zeek.org/t/syntax-error-in-policy/469/3 "2004-03-03T21:02:38Z")

</div>

You are correct, thank you very much. "log\_prelude" is a new keyword and is like  
the "log" keyword (with small differences). I was adapting the 8a20 patch  
searching for TOK\_LOG and adding the Prelude code. I don't know why but i've  
missed this change ☹

I've added these lines to parse.in

&nbsp;&nbsp;&nbsp;&nbsp;\> TOK\_LOG\_PRELUDE '(' expr\_list ')' ';'  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$$ = new LogPreludeStmt($3);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

and Bro run successfully. I'm going to test it a while and if it works fine i  
will post the patch.

Thanks again. Regards.  
Jose M Duart

Robin Sommer \<[sommer@in.tum.de](mailto:sommer@in.tum.de)\> va escriure:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/syntax-error-in-policy/469/4 "2022-05-06T15:36:56Z")

</div>