I'm having trouble running an external program in the callback function for an event when processing a pcap file. It seems to work in bro_init, however, which confuses me.
The working file will print out the output of the "ls" command, whereas the not-working file will not print out anything no matter how long I wait.
Specifically here I want to use the event when bro detects a file in the pcap.
working.bro (ran as simply "bro working.bro"):
notworking.bro (ran as bro -r my.pcap notworking.bro: