From 801c08e6455191892ba82c5533361191de40ff1e Mon Sep 17 00:00:00 2001
From: doug <doug.burks@gmail.com>
Date: Thu, 26 Dec 2019 17:00:22 -0500
Subject: [PATCH] more zeek cleanup

---
 bin/sostat                       |  2 +-
 debian/changelog                 |  6 ++++++
 debian/patches/more-zeek-cleanup | 36 ++++++++++++++++++++++++++++++++
 debian/patches/series            |  1 +
 4 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 debian/patches/more-zeek-cleanup

diff --git a/bin/sostat b/bin/sostat
index e44042b..e684ebb 100755
--- a/bin/sostat
+++ b/bin/sostat
@@ -234,7 +234,7 @@ if [ -d /nsm/sensor_data ] && [ $NUM_INTERFACES -gt 0 ]; then
 	echo "-------------------------------------------------------------------------"
 	echo
         TMP=`mktemp`
-        su sguil -c '/opt/zeek/bin/zeekctl netstats 2>&1 | grep -v "Warning: ZeekControl plugin uses legacy BroControl API. Use" | grep -v "'import ZeekControl.plugin' instead of 'import BroControl.plugin'" ' > $TMP
+        su sguil -c '/opt/zeek/bin/zeekctl netstats 2>&1 | grep -v "Warning: ZeekControl plugin uses legacy BroControl API. Use" | grep -v "import BroControl.plugin" | grep -v "^$" ' > $TMP
         if [ -s $TMP ]; then
                 echo "${underline}Zeek${normal}:"
                 echo
diff --git a/debian/changelog b/debian/changelog
index 0b3036d..b56d79e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+securityonion-sostat (20120722-0ubuntu0securityonion141) xenial; urgency=medium
+
+  * more zeek cleanup 
+
+ -- Doug Burks <doug.burks@gmail.com>  Thu, 26 Dec 2019 17:00:00 -0500
+
 securityonion-sostat (20120722-0ubuntu0securityonion140) xenial; urgency=medium
 
   * clean up zeek warnings 
diff --git a/debian/patches/more-zeek-cleanup b/debian/patches/more-zeek-cleanup
new file mode 100644
index 0000000..cbe87d5
--- /dev/null
+++ b/debian/patches/more-zeek-cleanup
@@ -0,0 +1,36 @@
+Description: <short summary of the patch>
+ TODO: Put a short summary on the line above and replace this paragraph
+ with a longer explanation of this change. Complete the meta-information
+ with other relevant fields (see below for details). To make it easier, the
+ information below has been extracted from the changelog. Adjust it or drop
+ it.
+ .
+ securityonion-sostat (20120722-0ubuntu0securityonion141) xenial; urgency=medium
+ .
+   * more zeek cleanup
+Author: Doug Burks <doug.burks@gmail.com>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: https://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- securityonion-sostat-20120722.orig/bin/sostat
++++ securityonion-sostat-20120722/bin/sostat
+@@ -234,7 +234,7 @@ if [ -d /nsm/sensor_data ] && [ $NUM_INT
+ 	echo "-------------------------------------------------------------------------"
+ 	echo
+         TMP=`mktemp`
+-        su sguil -c '/opt/zeek/bin/zeekctl netstats 2>&1 | grep -v "Warning: ZeekControl plugin uses legacy BroControl API. Use" | grep -v "'import ZeekControl.plugin' instead of 'import BroControl.plugin'" ' > $TMP
++        su sguil -c '/opt/zeek/bin/zeekctl netstats 2>&1 | grep -v "Warning: ZeekControl plugin uses legacy BroControl API. Use" | grep -v "import BroControl.plugin" | grep -v "^$" ' > $TMP
+         if [ -s $TMP ]; then
+                 echo "${underline}Zeek${normal}:"
+                 echo
diff --git a/debian/patches/series b/debian/patches/series
index 49e91e0..2685ec4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -132,3 +132,4 @@ securityonion-sostat:-improve-netsniff-packet-loss-calculation-Security-Onion-So
 securityonion-sostat:-migrate-from-Bro-to-Zeek-#1692
 update-copyright
 clean-up-zeek-warnings
+more-zeek-cleanup