[Bro-Dev] Notices done as event instead of function

[Seth Hall]

On Jun 2, 2011, at 1:49 PM, Vern Paxson wrote:

> That said, a better way of dealing with this concern would be to have
> a solid notion of event prioritization.


I just worked around this problem by allowing users to add anonymous functions to a set of functions that get called for each notice.  It's sort of a parallel track to the event based pathway that is only used when things need to be run closer to real time.

It will at least give us the ability to support the near realtime constraints of the drop script and the easy event based extension mechanism.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/