Bro is also sensitive to the following environment variables:
Default: if you don't set this variable, then Bro uses the path
.:policy:policy/local:/usr/local/lib/bro
That is, the current directory, any policy/ and policy/local/
subdirectories, and /usr/local/lib/bro/.
@load
directive. For a given prefix and load-name, Bro
constructs the filename:
prefix.load-name.bro(where it doesn't add .bro if load-name already ends in .bro). It then searches for the filename using $BROPATH and loads it if its found. Furthermore, it repeats this process for all of the other prefixes (left-to-right), and loads each file it finds for the different prefixes. Note: Bro also first attempts to load the filename without any prefix at all. If this load fails, then Bro exits with an error complaining that it can't open the given
@load
file.
For example, if you set $BRO_PREFIXES to:
mysite:mysite.wan
and then issue “@load ftp”, Bro will attempt to load each of the following scripts in the following order:
ftp.bro mysite.ftp.bro mysite.wan.ftp.bro
Default: if you don't specify a value for $BRO_PREFIXES, it defaults to empty, and for the example above Bro would only attempt to @load ftp.bro.