Raw reader always throws Error on non-zero return code

Description

This ticket is mostly to get a bit of feedback before I start making changes, as I am not 100% convinced what the right solution here is.

Currently, Bro always throws a Error message when a program is executed via the raw reader. This behavior cannot be disabled. This means that users will be flooded with Error-messages when trying to use Bro with external programs that are supposed to terminate with a non-zero return code.

This feels a bit odd, especially given that the Exec framework (which is probably the usual way to interact with external programs) deals perfectly well with non-zero return codes, giving the error code in the return record.

I propose two changes:

  • demote the Error message to a Warning; this does not seem to warrant an Error.

  • allow a user to specify that non-zero return codes do not throw errors.

I think we could also consider not throwing a Warning at all, at least when using the Exec framework - does anyone have an opinion on this?

Environment

None

Assignee

Johanna Amann

Reporter

Johanna Amann

Labels

None

External issue ID

None

Components

Affects versions

Priority

Normal
Configure