<div dir="ltr">Is it then a error in the doc? or error in the code?<div>I hope it's an error in the code :D</div><div><br></div><div>Should I make a bug report out of it?</div><div><br></div><div>e</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Apr 19, 2020 at 6:54 PM Victor Julien <<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 19-04-2020 18:46, Edward Fjellskål wrote:<br>
> <br>
> According to the docs, one should be able to use all the functions in<br>
> eater lua rules or lua output. But I cant seem to get ScFlowintGet to<br>
> work. Just errors here:<br>
> <br>
> [110340] 17/4/2020 -- 08:21:24 - (output-lua.c:289) <Info><br>
> (LuaPacketLogger) -- failed to run script:<br>
> /etc/suricata/lua-output//test.lua:19: attempt to call global<br>
> 'ScFlowintGet' (a nil value)<br>
> <br>
> Script is as follows:<br>
> <br>
> -- START<br>
> function init(args)<br>
>     local needs = {}<br>
>     needs["type"] = "flow"<br>
>     needs["type"] = "packet"<br>
>     needs["flowint"] = {"test"}<br>
>     return needs<br>
> end<br>
> <br>
> function setup (args)<br>
>   SCLogInfo("TEST setup")<br>
> end<br>
> <br>
> function deinit (args)<br>
>   SCLogInfo("TEST deinit")<br>
> end<br>
> <br>
> function log(args)<br>
>     --ipver, srcip, dstip, proto, sp, dp = SCFlowTuple()<br>
>     a = ScFlowintGet(0) -- Fails here!<br>
>     if a then<br>
>         ScFlowintSet(0, a + 1)<br>
>     else<br>
>         ScFlowintSet(0, 1)<br>
>     end<br>
>     SCLogInfo("TEST log")<br>
> end<br>
> -- END<br>
> <br>
> Is this supposed to work?<br>
<br>
Looks like it's only registered for the detection lua support, not for<br>
output.<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" rel="noreferrer" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" rel="noreferrer" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="https://suricata-ids.org/support/" rel="noreferrer" target="_blank">https://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Forum: <a href="https://forum.suricata.io" rel="noreferrer" target="_blank">https://forum.suricata.io</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/training/</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Edward Bjarte Fjellskål<br>Senior Security Analyst<br><a href="http://www.gamelinux.org/" target="_blank">http://www.gamelinux.org/</a></div>