theflakes / bro-large_uploads Goto Github PK

After renaming the files to the .zeek extension I am getting the following error:
error in /opt/zeek/share/zeek/site/bro-large_uploads/./large_uploads.zeek, lines 94-128: LargeUploads::dst is used inside "when" statement but not captured (when (LargeUploads::src = lookup_addr(LargeUploads::c$id$orig_h)) { LargeUploads::susOrigs[LargeUploads::c$id$orig_h] += 1if (LargeUploads::maxNumUp <= LargeUploads::susOrigs[LargeUploads::c$id$orig_h]) { NOTICE((coerce [$note=LargeUploads::Multiple_Large_Outgoing_Tx, $msg=fmt(Orig Txed multiple large uploads. Source name %s., LargeUploads::src), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c, $suppress_for=8.0 hrs, $identifier=cat(LargeUploads::c$id$orig_h)] to Notice::Info))}if (LargeUploads::maxTx < LargeUploads::c$orig$num_bytes_ip) { NOTICE((coerce [$note=LargeUploads::Very_Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}else{ NOTICE((coerce [$note=LargeUploads::Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}})
error in /opt/zeek/share/zeek/site/bro-large_uploads/./large_uploads.zeek, lines 94-128: LargeUploads::endTime is used inside "when" statement but not captured (when (LargeUploads::src = lookup_addr(LargeUploads::c$id$orig_h)) { LargeUploads::susOrigs[LargeUploads::c$id$orig_h] += 1if (LargeUploads::maxNumUp <= LargeUploads::susOrigs[LargeUploads::c$id$orig_h]) { NOTICE((coerce [$note=LargeUploads::Multiple_Large_Outgoing_Tx, $msg=fmt(Orig Txed multiple large uploads. Source name %s., LargeUploads::src), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c, $suppress_for=8.0 hrs, $identifier=cat(LargeUploads::c$id$orig_h)] to Notice::Info))}if (LargeUploads::maxTx < LargeUploads::c$orig$num_bytes_ip) { NOTICE((coerce [$note=LargeUploads::Very_Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}else{ NOTICE((coerce [$note=LargeUploads::Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}})
error in /opt/zeek/share/zeek/site/bro-large_uploads/./large_uploads.zeek, lines 94-128: LargeUploads::c is used inside "when" statement but not captured (when (LargeUploads::src = lookup_addr(LargeUploads::c$id$orig_h)) { LargeUploads::susOrigs[LargeUploads::c$id$orig_h] += 1if (LargeUploads::maxNumUp <= LargeUploads::susOrigs[LargeUploads::c$id$orig_h]) { NOTICE((coerce [$note=LargeUploads::Multiple_Large_Outgoing_Tx, $msg=fmt(Orig Txed multiple large uploads. Source name %s., LargeUploads::src), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c, $suppress_for=8.0 hrs, $identifier=cat(LargeUploads::c$id$orig_h)] to Notice::Info))}if (LargeUploads::maxTx < LargeUploads::c$orig$num_bytes_ip) { NOTICE((coerce [$note=LargeUploads::Very_Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}else{ NOTICE((coerce [$note=LargeUploads::Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}})
warning in /opt/zeek/share/zeek/site/bro-large_uploads/./large_uploads.zeek, lines 72-129: "when" statement referring to locals without an explicit [] capture is deprecated: LargeUploads::endTime, LargeUploads::c (when (LargeUploads::dst = lookup_addr(LargeUploads::c$id$resp_h)) { if (LargeUploads::my_domain_suffixes in LargeUploads::dst) return LargeUploads::endTime = LargeUploads::c$start_time + LargeUploads::c$durationLargeUploads::susResps[LargeUploads::c$id$resp_h] += 1if (LargeUploads::maxNumUp <= LargeUploads::susResps[LargeUploads::c$id$resp_h]) { NOTICE((coerce [$note=LargeUploads::Multiple_Large_Outgoing_Tx, $msg=fmt(Dest received multiple large uploads from internal IP(s). Dest name %s., LargeUploads::dst), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c, $suppress_for=8.0 hrs, $identifier=cat(LargeUploads::c$id$resp_h)] to Notice::Info))}when (LargeUploads::src = lookup_addr(LargeUploads::c$id$orig_h)) { LargeUploads::susOrigs[LargeUploads::c$id$orig_h] += 1if (LargeUploads::maxNumUp <= LargeUploads::susOrigs[LargeUploads::c$id$orig_h]) { NOTICE((coerce [$note=LargeUploads::Multiple_Large_Outgoing_Tx, $msg=fmt(Orig Txed multiple large uploads. Source name %s., LargeUploads::src), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c, $suppress_for=8.0 hrs, $identifier=cat(LargeUploads::c$id$orig_h)] to Notice::Info))}if (LargeUploads::maxTx < LargeUploads::c$orig$num_bytes_ip) { NOTICE((coerce [$note=LargeUploads::Very_Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}else{ NOTICE((coerce [$note=LargeUploads::Large_Outgoing_Tx, $msg=fmt(Orig transmitted %d bytes to resp. Duration %s sec. Source is %s. Destination is %s. Connection UID %s., LargeUploads::c$orig$num_bytes_ip, LargeUploads::c$duration, LargeUploads::src, LargeUploads::dst, LargeUploads::c$uid), $sub=fmt(Tx start: %s UTC, end: %s UTC, strftime(%m/%d/%Y %H:%M:%S, LargeUploads::c$start_time), strftime(%m/%d/%Y %H:%M:%S, LargeUploads::endTime)), $conn=LargeUploads::c] to Notice::Info))}}})