[Bro-Dev] &log attribute

[Adam J. Slagell]

On Mar 27, 2011, at 9:42 PM, Seth Hall wrote:

> 
> On Mar 27, 2011, at 1:55 PM, Robin Sommer wrote:
> 
>> The reason is that if I pass a record in for logging, chances are that
>> I want something logged. If there's no explicit &log attribute, it
>> seems natural to assume that one wants to log everything. That also
>> looks nicer and is less cumbersome than having to add &log to every
>> single field to get the same effect. And I don't really see how one
>> would pass a record to logging with the intention of *not* logging
>> anything.
>> 
>> Makes sense?
> 
> Haha!  That does make sense.  I still sort of think I'd rather have the attribute be required though.  
> 
> Oh!  I just thought of an example.  Someone could write that it collects state, but none of it is ever logged because it's only intended to extended and built upon in further scripts.  If we had the "absence of &log means log everything" convention, it would want to log our state tracking variables.  It also becomes really confusing since we can extend record types in other locations and things that would formerly log are suddenly not being logged because the type was extended and a one of the extended values had the &log attribute.

I'd rather have a separate syntax to log all fields than to just assume that not using the attribute anywhere has this opposite behavior.