[Bro-Dev] metrics framework

Vern Paxson vern at icir.org
Wed May 18 02:04:33 PDT 2011


I like where this is going in general.

> > - Missing support for cluster deployment.
> 
> Yeah, that's a tough one. Full &synchronize would be overkill, but
> sending the data via events, like you suggest, also sounds quite
> expensive if there are lots of entities for which something's counted.

What about a notion of "reduce", similar to the reduce operation in
map-reduce?  It seems for a lot of metrics/statistics/time-series there
will be a natural way of combining parallelized computation of a given
sort over the sequence of values.

		Vern


More information about the bro-dev mailing list