[Bro-Dev] &log attribute

Seth Hall seth at icir.org
Sun Mar 27 19:42:27 PDT 2011

On Mar 27, 2011, at 1:55 PM, Robin Sommer wrote:

> The reason is that if I pass a record in for logging, chances are that
> I want something logged. If there's no explicit &log attribute, it
> seems natural to assume that one wants to log everything. That also
> looks nicer and is less cumbersome than having to add &log to every
> single field to get the same effect. And I don't really see how one
> would pass a record to logging with the intention of *not* logging
> anything.
> Makes sense?

Haha!  That does make sense.  I still sort of think I'd rather have the attribute be required though.  

Oh!  I just thought of an example.  Someone could write that it collects state, but none of it is ever logged because it's only intended to extended and built upon in further scripts.  If we had the "absence of &log means log everything" convention, it would want to log our state tracking variables.  It also becomes really confusing since we can extend record types in other locations and things that would formerly log are suddenly not being logged because the type was extended and a one of the extended values had the &log attribute.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the bro-dev mailing list