[Bro] &write_expire functionality
seth at corelight.com
Mon Oct 30 17:22:06 PDT 2017
Whoops, I replied off list. For everyone else's sake, here's what I
came to based on digging around a bit...
It doesn't work that way. You may want to change the record and then
save the record back to the table. The snippet would look like this
local x = my_table[index_value];
x$fieldname += 1;
my_table[index_value] = x;
That should make the timeouts work right. :)
On 30 Oct 2017, at 13:38, Seth Hall wrote:
> Unfortunately I don't think it will. Mutable types break some
> assumptions in Bro and this is one of them. I will do some testing
> this afternoon to verify if that's actually true though.
> On 30 Oct 2017, at 13:20, Lamps, Jereme wrote:
>> If I have:
>> global my_table: table[string] of vector of HTTP::Info &write_expire
>> = 5mins;
>> Will the timeout reset for a particular string entry if I modify a
>> single element within one of the HTTP::Info records?
>> Bro mailing list
>> bro at bro-ids.org
> Seth Hall * Corelight, Inc * www.corelight.com
Seth Hall * Corelight, Inc * www.corelight.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro