[Bro] Using the &persistent attribute

Robin Sommer robin at icir.org
Tue Jan 23 19:34:40 PST 2018

On Mon, Jan 22, 2018 at 14:17 +0000, Lamps, Jereme wrote:

> To get this to work do I simply
> need the &persistent attribute and Bro magically handles the rest? Or
> do I also need to use the functions checkpoint_state() (in bro_done)
> with rescan_state (in bro_init) to load the tables?

The former: at startup and termination checkpoint_state() and
rescan_state are called automatically, respectively. You can in
addition call them during operation for checkpointing/rereading the
state on the fly.

That said, please note that &persistent is going to go away, it will
likely be deprecated starting with Bro 2.6. Broker's data stores are
going to be the primary replacement.


Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin

More information about the Bro mailing list