[Bro-Dev] &log attribute

[Vern Paxson]

> I was about to say something similar: why don't we go with the &log
> attribute for now and generalize to user-definable attributes if/when
> we find more use cases?

I had (for some reason) thought that the processing of this attribute was
mostly at script-level.  If it's indeed instead in the core [*], then I agree
it makes sense to not generalize at this point.

		Vern


[*] Yes, you got me to use the term "core".  "Event engine" doesn't sound
    right for something like this which isn't at all about generating
    events.  (Which just makes me think it should in fact be implemented
    at the script level. ;-)