[Bro-Dev] &log attribute
vern at icir.org
Wed Mar 23 09:14:07 PDT 2011
> I was about to say something similar: why don't we go with the &log
> attribute for now and generalize to user-definable attributes if/when
> we find more use cases?
I had (for some reason) thought that the processing of this attribute was
mostly at script-level. If it's indeed instead in the core [*], then I agree
it makes sense to not generalize at this point.
[*] Yes, you got me to use the term "core". "Event engine" doesn't sound
right for something like this which isn't at all about generating
events. (Which just makes me think it should in fact be implemented
at the script level. ;-)
More information about the bro-dev