process command misplaces custom scripts

Description

broctl process trace.pcap test.bro gives:

I believe it's due to test.bro being placed in the middle of the command line that process builds. If I move it to the end, it works fine.

Environment

None

Activity

Show:
Daniel Thayer
January 31, 2014, 5:24 AM

If you run "broctl process" with a custom script, then you need
to specify "--" so that broctl knows where the Bro options end
and where the custom scripts begin. So your example
should be:
broctl process trace.pcap – test.bro

Doing so moves test.bro farther down towards the end
of the Bro command line.

However, in this example we still get a different error,
because broctl adds its own script (process-trace.bro,
which contains a couple of redefs) at the very end of
the Bro command. I will change the order so that the
process-trace.bro is before the custom scripts (which
solves the syntax error).

Daniel Thayer
January 31, 2014, 12:34 PM

In branch topic/dnthayer/ticket1124, I've changed the order of
scripts so that user-specified scripts are always at the end of
the Bro command, and I've improved the broctl help message
to show how the process command should be used.

Merged

Assignee

Unassigned

Reporter

Robin Sommer

Labels

None

External issue ID

None

Components

Fix versions

Affects versions

Priority

Normal