[Bro] Updating table in SumStats - not recognized in outer event

Shiran Aizik chegov at gmail.com
Mon Apr 18 07:59:55 PDT 2016


I have a global synced table which I update on threshold_crossed in
The update is successful, yet when I try to access this table from a
different event (dns query reply) it is empty.
I work wih bro 2.4.1 in cluster mode. The table is defined as global,
synced and mergable.
My goal is that all workers will send their observations to SumStats and
based on a threshold, update a table for all the workers to know.

Any ideas what can I try ?

Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160418/f5135eda/attachment.html 

More information about the Bro mailing list