[Bro-Dev] &log attribute

Jonathan Siwek jsiwek at ncsa.illinois.edu
Tue Mar 22 07:57:20 PDT 2011

> I think that the &log attribute would make the interfaces to these scripts
> quite a bit more palatable and enjoyable to use.
> Thoughts?

I haven't worked w/ the new upcoming log framework for my opinion to carry much weight, but it does look like a &log attribute might make more sense and simplify things for a script writer.

> Although that attribute is annoying use case specific

I don't really get why it has to be use-case specific and not a general way to convey to the logging framework that "only these record fields" are meant to be logged.  Is it just a problem because it requires more verbosity in the case that all fields are meant to be logged (i.e. script writer might forget to add the &log attribute) ?  Or is there an example you can give to explain what you mean?

- Jon

More information about the bro-dev mailing list