<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Seems like either way would work - I've used the idea of keeping a list of keys to delete after loop exit (not in bro, actually, but in awk, which has a similar paradigm), but since we're peeling off keys, and discarding them after usage, avoiding the additional loop seemed more natural/efficient - although I suppose my way of looping over the keys, just to gather the first item, and breaking out may not seem too natural or be particularly efficient.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">I'll try your changes to see if they accomplish the same things. Based on Justin's post, I'm now more concerned about running my code on a cluster, but will tackle that next.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 18, 2018 at 9:50 AM, Jon Siwek <span dir="ltr"><<a href="mailto:jsiwek@corelight.com" target="_blank">jsiwek@corelight.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wed, Jan 17, 2018 at 6:30 PM, Jim Mellander <<a href="mailto:jmellander@lbl.gov">jmellander@lbl.gov</a>> wrote:<br>
<br>
> Unfortunately, the reschedule<br>
> is:<br>
> schedule 0.01 secs { process_epoch_result(ss, now, data1) };<br>
> instead of:<br>
> schedule 0.01 secs { SumStats::process_epoch_<wbr>result(ss, now, data1) };<br>
> so it silently fails after the first 50 results.<br>
<br>
</span>Thanks, you're right about that.<br>
<span class=""><br>
> Would be nice to have a<br>
> warning if a script schedules an event that doesn't exist.<br>
<br>
</span>Right again, it would be nice since it has resulted in bugs like this,<br>
though I recall it might not be an easy change to the parser to clear<br>
up the differences in namespacing rules for event identifiers.<br>
<span class=""><br>
> Attached please find hash_test.bro & (patched) non-cluster.bro<br>
<br>
</span>Thanks for those. I remember you pointing out the potential problem<br>
in the earlier mail and meant to respond to indicate we should fix it<br>
and I must have just forgot, so sorry for that. I had a bit of a<br>
different idea on how to address the iterator invalidation that might<br>
be more understandable: keep a separate list of keys to delete later,<br>
outside the loop. I have my version of your proposed fixes at [1].<br>
Can you take a look and let me know if that works for you?<br>
<br>
- Jon<br>
<br>
[1] <a href="https://github.com/bro/bro/commit/3495b2fa9d84e8105a79e24e4e9a2f9181318f1a" rel="noreferrer" target="_blank">https://github.com/bro/bro/<wbr>commit/<wbr>3495b2fa9d84e8105a79e24e4e9a2f<wbr>9181318f1a</a><br>
</blockquote></div><br></div>