[Bro-Dev] #375: Extending record type fields

Bro Tracker bro at tracker.icir.org
Thu Feb 3 18:18:21 PST 2011


#375: Extending record type fields
------------------------------+---------------------
  Reporter:  seth             |      Owner:
      Type:  Feature Request  |     Status:  new
  Priority:  Normal           |  Milestone:  Bro1.6
 Component:  Bro              |    Version:
Resolution:                   |   Keywords:  logging
------------------------------+---------------------

Comment (by gregor):

 A problem with this extension is that the order of fields in the record
 will then depend on the order of the redefs and thus possibly on the order
 in which policy scripts are loaded. (Maybe this won't happen for the
 logging framework but it can happen in general).
 So, if the event engine uses positions/indexes to assign values to record
 fields then there might be a problem. The event engine could do lookups
 for the field names instead, but this seems to be hardly used

-- 
Ticket URL: <http://tracker.icir.org/bro/ticket/375#comment:1>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list