[Bro-Dev] &log attribute

[Robin Sommer]

One more question regarding this: Seth and I had discussed earlier
that if a record does not have any "&log" fields, the logging
framework could by default log all fields. We dismissed that as "too
much magic", but thinking about it again, I'd like to reconsider.

The reason is that if I pass a record in for logging, chances are that
I want something logged. If there's no explicit &log attribute, it
seems natural to assume that one wants to log everything. That also
looks nicer and is less cumbersome than having to add &log to every
single field to get the same effect. And I don't really see how one
would pass a record to logging with the intention of *not* logging
anything.

Makes sense?

Robin


-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org