[Bro-Dev] &log attribute

[Seth Hall]

On Mar 27, 2011, at 10:56 PM, Adam J. Slagell wrote:

> I'd rather have a separate syntax to log all fields than to just assume that not using the attribute anywhere has this opposite behavior.


Just for the record, I don't think this would be appropriate either due to the recent record extension mechanism.  It would essentially prohibit someone from including non-logged state information in a script extending one of the logging records with the separate syntax indicating "log all".

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/