From 9a0345ed08db076851bcb1d0524f70f7d45451c6 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@corelight.com>
Date: Tue, 22 Feb 2022 13:00:47 +0100
Subject: [PATCH 1/2] Adapt to package's new default listening port.

---
 src/io/zeek.cc | 2 +-
 zeek-agent     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/io/zeek.cc b/src/io/zeek.cc
index 2968991a..3ae6a0ed 100644
--- a/src/io/zeek.cc
+++ b/src/io/zeek.cc
@@ -136,7 +136,7 @@ class BrokerConnection {
 Result<Nothing> BrokerConnection::connect(const std::string& destination) {
     // Parse "host[:port]".
     std::string address;
-    unsigned long port = 9999; // default Broker port
+    unsigned long port = 9998; // default port used by the zeek-agent package
 
     try {
         auto m = split(trim(destination), ":");
diff --git a/zeek-agent b/zeek-agent
index becd56f4..7e3e36e9 160000
--- a/zeek-agent
+++ b/zeek-agent
@@ -1 +1 @@
-Subproject commit becd56f4e0168eb033304c289db5f8024e874a4a
+Subproject commit 7e3e36e9b09eff2bd8c7ade1281ec4d559f1824a

From f1d7e0fe287b48f72e85fe4cc5f9c408d11fbccd Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@corelight.com>
Date: Tue, 22 Feb 2022 13:09:13 +0100
Subject: [PATCH 2/2] Fix problem with column caching.

---
 src/core/database.cc | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/core/database.cc b/src/core/database.cc
index 60a6b6e7..3b139647 100644
--- a/src/core/database.cc
+++ b/src/core/database.cc
@@ -259,10 +259,13 @@ Interval Database::Implementation::timerCallback(timer::ID id) {
         else
             cannot_be_reached();
 
-        if ( sql_result->columns.empty() )
-            // If a result is empty, columns won't be set. Reuse the previous one then because for diffs we may still be
-            // sending (removed) rows back.
-            sql_result->columns = (*i)->previous_result->columns;
+        if ( sql_result->columns.empty() ) {
+            if ( (*i)->previous_result )
+                // If a result is empty, columns won't be set. Reuse the previous
+                // one then because for diffs we may still be
+                // sending (removed) rows back.
+                sql_result->columns = (*i)->previous_result->columns;
+        }
 
 #ifndef NDEBUG
         else if ( (*i)->previous_result ) {