I have a file that gets updated every hour and I am using it as a feed into bro using input framework. Every hour I write a list of IP addresses into this file. For many updates everything works fine but Occasionally, I see the following error:
Apr 6 05:00:09 Reporter::ERROR /feeds/Blacklist/CURRENT.24hrs_BRO/Input::READER_ASCII: could not read first line (empty)
After this failure/message, any subsequent updates on the file are ignored by the input framework.
From visual inspection the file looks just fine and header/data (1 column of IP addresses) is there as expected but somehow input framework doesn't like it. It seems that every hour when update the file using a cron script, on a rare occasion the file is empty for a minuscule duration after which this error starts.
for further REREADS data won't get updated into the tables anymore once the above Reporter::ERROR kicks in.
Please let me know if you need ways to reproduce this error condition or have more questions for me.