[Bro-Dev] #498: Efficiency problem with remote log flushing

[Bro Tracker]

#498: Efficiency problem with remote log flushing
----------------------+------------------------
  Reporter:  robin    |      Owner:  robin
      Type:  Problem  |     Status:  reopened
  Priority:  Normal   |  Milestone:  Bro1.6
 Component:  Bro      |    Version:  git/master
Resolution:           |   Keywords:  beta
----------------------+------------------------
Changes (by jsiwek):

 * status:  closed => reopened
 * resolution:  fixed =>


Comment:

 This seems to make it so that log buffers may be flushed at a frequency
 lower than that of the rotation interval of a remote peer, dependent on
 traffic volume & amount of writes that happen to a given stream.  So for a
 given rotation interval, the remote peer's logs might have none of the
 content actually logged in that interval because it wasn't flushed yet or
 content from previous intervals gets mixed in because the flush was
 delayed too long.

 Does there need to be a negotiation of log flushing around rotation to
 make low volume remote logs always rotate properly?

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/498#comment:4>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker