[Bro-Dev] &log attribute
jsiwek at ncsa.illinois.edu
Tue Mar 22 11:15:50 PDT 2011
> It's a non-reusable attribute. It only applies in this one scenario,
I think I understand now, tell me if this rephrasing is wrong -- in practice you'd only ever use &log in record types that get passed to the logging framework and it doesn't make sense to tag any other identifiers with it (which, if done, shouldn't actually do anything).
> It would be nice for documentation generation too because there isn't
> any question about what fields/records are intended for the logging
> framework. In the existing model, there would need to be some sort of
> indicator for a record to indicate that the record is intended for the
> logging framework because you don't want to guess based on the type
Yeah. It does seem to simplify (at least part of) this task as well.
More information about the bro-dev