This ticket is mostly to get a bit of feedback before I start making changes, as I am not 100% convinced what the right solution here is.
Currently, Bro always throws a Error message when a program is executed via the raw reader. This behavior cannot be disabled. This means that users will be flooded with Error-messages when trying to use Bro with external programs that are supposed to terminate with a non-zero return code.
This feels a bit odd, especially given that the Exec framework (which is probably the usual way to interact with external programs) deals perfectly well with non-zero return codes, giving the error code in the return record.
I propose two changes:
demote the Error message to a Warning; this does not seem to warrant an Error.
allow a user to specify that non-zero return codes do not throw errors.
I think we could also consider not throwing a Warning at all, at least when using the Exec framework - does anyone have an opinion on this?