Input framework: table name truncated at underscore
Description
When loading a table in the input framework, e.g.:
Input::add_table([ $source="/tmp/sdb_servers",
$name="sdb_servers",
$idx=sdb_servers_idx,
$val=sdb_servers_val,
$destination=sdb_servers,
$mode=Input::REREAD
]);
And later on reporting when the input has been fully read:
event Input::end_of_data(name: string, source: string)
{
Reporter::info(fmt("Input stream name %s source %s ready", name, source));
}
This is what ends up in the reporter log:
0.000000 Reporter::INFO Input stream name sdb source /tmp/sdb_servers ready <script location redacted>, line 101
So it is truncating the input stream name before the underscore.
Environment
Activity
Fixed in topic/johanna/ticket-1294; the exec module was changing the parameters given to the event.
Commit: https://github.com/bro/bro/commit/5836feb64dd5c7b3a2dae7f59dbfaf8e1eae1407
Assignee
Reporter
Labels
External issue ID
Components
Fix versions
Affects versions
Priority
