[Bro] write_expire computational time
johanna at icir.org
Tue Apr 25 07:54:39 PDT 2017
the main function implementing expiry is TableVal::DoExpire in Val.cc
(approximately line 2175).
> Basically, I want to know if I have a table with n elements, and each
> element should expire 1 minute after its insertion - will bro loop over all
> elements in the list checking if they are expired ?
Yes, Bro will loop over all elements from time to time, setting internal
timeouts that cause a loop over the whole table removing expired elements.
Note that elements are not guaranteed to expire after the expiration time;
they will be removed sometime after expiration time, but it can take a
> if this is the case then write_expire should be O(n), is this correct ?
The time overhead of expiration is O(n), correct.
More information about the Bro