<div dir="ltr"><div dir="ltr"><div dir="ltr">
Hey,<div><br></div><div>do we have any example how to replace the old &synchronized attribute in the new Broker-powered world? I looked at the documentation (it's extremely verbose) and found nothing that I could relate to.</div><div><br></div><div>Here is the pattern I'm trying to port to 2.6. It's basically a code that uses the Input Framework, reads some lists, stores them in a simple set and keeps this set synchronized.</div><div>The problem might be coming from a not obvious behavior of the &synchronized attribute - I had no idea what it did, I knew that it was supposed to be there.</div><div><br></div><div>The old 2.5.5 documentation mentions this attribute briefly</div><div><a href="https://docs.zeek.org/en/stable/script-reference/attributes.html">https://docs.zeek.org/en/stable/script-reference/attributes.html</a></div><div><br></div><div>&synchronized - synchronize a variable across nodes <- what nodes are we talking about? what's the communication flow here? Who is the producer, who is the consumer?</div><div>It is impossible to move my scripts over to Broker without answering those questions.</div><div><br><br>type Idx: record {<br> whitelist_ip: subnet;<br>};<br><br>global whitelist_scan_ip: set[subnet] = {} <b>&synchronized</b>; <-- the boo-boo is here<br><div><br></div><div>event bro_init()<br>{<br> Input::add_table([$source="scan_ip.txt",<br> $name="whitelist_scan_ip",<br> $idx=Idx,<br> $destination=whitelist_scan_ip,<br> $mode=Input::REREAD]);<br>}</div></div><div><br></div></div></div></div>