[Bro-Dev] active_conns

Robin Sommer robin at icir.org
Mon Mar 21 10:09:54 PDT 2011

On Thu, Mar 17, 2011 at 21:34 -0400, you wrote:

> instance of a ::Log type.  Data is stored sort of haphazardly (which I
> don't particularly like) in either ::Info or ::Log depending on if

Yeah, that's bothering me a bit too, but I'm not sure how to solve it

Well, here's an idea: with the new record-to-sub-record coercion, I
believe we could store *all* information in the Info record, and still
define a separate Log record for determining what gets logged (by

  type Info = record { count a; count b; count c; }
  type Log  = record { count a; count b; }

We use Log to create the logging stream, and Info to fill in the data.
When time for logging comes around, we simply pass the Info instance
into the Log:write() function and it will log whatever is defined in
Log, via coercion. (Actually I don't believe this would work right now
because of internals of the log bif, but it should be doable) 

Advantage:    Only one type of record to fill in.

Disadvantage: Two record types to define and maintain, both of which
              need to match for the logged fields (i.e., redundancy). 


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the bro-dev mailing list