[Bro] change policy at run time
sommer at in.tum.de
Wed Jun 8 00:14:57 PDT 2005
On Mon, Jun 06, 2005 at 21:20 -0400, you wrote:
> Is there any way that I can change policy at run time, i.e, adjust some
> sensitivity parameters without stopping and restarting Bro?
Yes, in fact there is. In a nutshell: run Bro with checkpoint.bro.
Then, if you want to change something, edit the config and start Bro
with option -g. The new instance will dump its config into
.state/config.bst and exit. Then you can copy config.bst into the
running Bro's .state directory and it will pick it up.
Caveat: This is still experimental; I don't think that many people
have played with it yet...
> When will Bro have the capability of reading disk files?
Not sure. I think there are plans for supporting script-level
input/output eventually, but I don't know if anybody is already
working on it.
Robin Sommer * Room 01.08.055 * www.net.in.tum.de
TU Muenchen * Phone (089) 289-18006 * sommer at in.tum.de
More information about the Bro