[Bro] BRO and SQL

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon Oct 29 08:03:00 PDT 2012

> Seth's information on "broctl update", reproduced below has proven useful to us when changing const variables (sounds like a contradiction!), such as maintanance of whitelists or blacklists, without restarting bro.  I've been thinking about some use cases of redef'ing consts, where I would like to cook the data in the consts.  This I typically do with a bro_init event handler when bro starts up.  Is there some way to trigger an event when these updates occur, so that the updated variable can be recooked?

A general event called "Control::configuration_update" gets queued when a nodes configuration gets changed by e.g. `broctl update`.  So handling that I think should be an indication that the node's redef'able consts may have changed.  Maybe that will work for what you want to do?


More information about the Bro mailing list