[Bro] Using the &persistent attribute
jlamps at sandia.gov
Mon Jan 22 06:17:14 PST 2018
I am a little confused as to how this attribute will work. Ideally I would like a state table that persists across numerous iterations of stopping/starting bro (broctl deploy).
To get this to work do I simply need the &persistent attribute and Bro magically handles the rest?
Or do I also need to use the functions checkpoint_state() (in bro_done) with rescan_state (in bro_init) to load the tables?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro