[Bro-Dev] #375: Extending record type fields
Bro Tracker
bro at tracker.icir.org
Thu Feb 3 18:18:21 PST 2011
#375: Extending record type fields
------------------------------+---------------------
Reporter: seth | Owner:
Type: Feature Request | Status: new
Priority: Normal | Milestone: Bro1.6
Component: Bro | Version:
Resolution: | Keywords: logging
------------------------------+---------------------
Comment (by gregor):
A problem with this extension is that the order of fields in the record
will then depend on the order of the redefs and thus possibly on the order
in which policy scripts are loaded. (Maybe this won't happen for the
logging framework but it can happen in general).
So, if the event engine uses positions/indexes to assign values to record
fields then there might be a problem. The event engine could do lookups
for the field names instead, but this seems to be hardly used
--
Ticket URL: <http://tracker.icir.org/bro/ticket/375#comment:1>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list