make install-brolite does not install all required files

[robin]

From: Aashish Sharma
Date: Fri, 17 Oct 2008 17:30:09

Reading changelog says brolite may be deprecated. I see current > 1.4 release is missing ../etc/bro.rc, ../etc/bro.cfg and ../site
/local.site.bro files amongst others evenafter running "make
install-brolite".

[robin]

While BroLite? is deprecated with 1.4, we shouldn't unnecessarily break it. I'll see whether I can get the files back in place.

[robin]

Attached is a patch which should fix the problems but it needs some testing from somebody who is actually using BroLite?. After applying the patch to 1.4, "make install-brolite" should install the same set of BroLite? files as 1.3 used to do (except for the new policy locations).

[robin]

I am new to Bro and the list so Greetings.

Some feedback as requested.

I am installing on Slackware 10.2.0 (old I know) gcc version 3.3.6,
which was pretty straight forward although I have snort/libpcap etc
installed from source and a PF Ring kernel so it is far from a vanilla
Slackware. I had done a 'manual' install of Bro 1.4 prior to patching
Bro for a BroLite? install, I deleted and re-installed as I felt that I
had missed a few things which did turn out to be the case e.g the perl
reporting scripts.

From Peter Hart-Davis:

On patching and running "make install-brolite" all seems good 'out of
the box' except I had to add "/usr/local/bro/site" to BROPATH in
etc/bro.cfg, from my reading I gather this is likely due to a new
location of site to share/bro/site? A suggestion, possibly a simple
'what goes where' or 'what is to be expected where' in the docs?

[robin]

(The previous comment is *all* from From Peter Hart-Davis.)

[robin]

More from Peter Hart-Davis:

Unfortunately it put the files into /usr/local/bro/site and not into
/usr/local/bro/share/site i.e. a bug.

[robin]

I'm attaching a new version of the patch which will hopefully fix the problem.