Bug #345
prelude-correlator - ERROR: LUA error - attempt to call a nil value
Start date:
Due date:
% Done:
0%
Resolution:
fixed
Description
Hi,
I'm trying to build a new lua rule following the wiki
I'm using debian lenny repo prelude-correlator 0.9.0~beta3-1
When launching prelude-correlator I got:
05 Mar 10:00:43 (process:6907) INFO: LUA plugin loaded 6 rulesets. 05 Mar 10:00:43 (process:6907) INFO: Connecting to 127.0.0.1:4690 prelude Manager server. 05 Mar 10:00:43 (process:6907) INFO: TLS authentication succeed with Prelude Manager. 05 Mar 10:00:43 (process:6907) ERROR: LUA error on 'test': attempt to call a nil value. (lua.c:148 lua_run) 05 Mar 10:00:43 (process:6907) ERROR: LUA error on 'test': attempt to call a nil value. (lua.c:148 lua_run) 05 Mar 10:00:43 (process:6907) ERROR: LUA error on 'test': attempt to call a nil value. (lua.c:148 lua_run)
and my rule test.lua is so basic...
function my_rule(INPUT)
local classification = INPUT:get("alert.classification.text")
print("*** " .. classification)
end
Hope it's just a syntax detail !
History
#1 Updated by about 15 years ago
Whow...
i got it :)
the <function name> MUST BE the same than the <rulename>.lua
sorry
hope this at least helps the next one !
#2 Updated by Yoann VANDOORSELAERE about 15 years ago
- Status changed from New to Closed
- Resolution set to fixed
Prelude-Correlator need to have a base function to call for each ruleset, which is why we currently use the filename. This might be changed in the future with a better scheme.
Regards,
#3 Updated by Yoann VANDOORSELAERE almost 15 years ago
- Project changed from PRELUDE SIEM to Prelude Correlator
- Category deleted (
11) - Target version deleted (
91)