[Bro-Dev] &log attribute

Jonathan Siwek jsiwek at ncsa.illinois.edu
Tue Mar 22 11:15:50 PDT 2011


> It's a non-reusable attribute. It only applies in this one scenario,

I think I understand now, tell me if this rephrasing is wrong -- in practice you'd only ever use &log in record types that get passed to the logging framework and it doesn't make sense to tag any other identifiers with it (which, if done, shouldn't actually do anything).

> It would be nice for documentation generation too because there isn't
> any question about what fields/records are intended for the logging
> framework. In the existing model, there would need to be some sort of
> indicator for a record to indicate that the record is intended for the
> logging framework because you don't want to guess based on the type
> name.

Yeah.  It does seem to simplify (at least part of) this task as well.

- Jon


More information about the bro-dev mailing list