[ https://bro-tracker.atlassian.net/browse/BIT-1181?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16103#comment-16103 ]
Bernhard Amann commented on BIT-1181: ------------------------------------- Adding an option to make input errors fatal would not be too hard - we also could add an event that is thrown in the case of an error to allow a user to handle stuff like that themselves more gracefully. But I think we should leave the default as non-fatal. Though the errors are easy to miss at the moment. > Input-framework errors should be fatal (or Notice_Alarm) instead of silent > reporter::error failures > --------------------------------------------------------------------------------------------------- > > Key: BIT-1181 > URL: https://bro-tracker.atlassian.net/browse/BIT-1181 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.2 > Reporter: Aashish Sharma > Assignee: Bernhard Amann > Labels: input-framework > > I noticed many times that if there is a problem in a feed file (syntax, or > some other issue) and input-framework is unable to read the file, it > generates a Reporter::Error. This is a silent failure condition ie bro > continues to operate as normal and the error is logged into reporter log. > Ideally above is the right thing to do. However, This failure results in no > data in the tables getting updated any more while I continue to operate > under-impression that Bro is working fine (unless I have explicitly been > looking at reporter log for this issue , which now I do). > If input-framework is unable to read/digest data from a feed, I believe that > should be a (configurable) fatal error or something which at least triggers > an alarm/alert/email. -- This message was sent by Atlassian JIRA (v6.3-OD-02-026#6318) _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev