[Bro-Dev] #498: Efficiency problem with remote log flushing

Bro Tracker bro at tracker.bro-ids.org
Wed Oct 5 11:48:50 PDT 2011

#498: Efficiency problem with remote log flushing
  Reporter:  robin    |      Owner:  robin
      Type:  Problem  |     Status:  reopened
  Priority:  Normal   |  Milestone:  Bro1.6
 Component:  Bro      |    Version:  git/master
Resolution:           |   Keywords:  beta
Changes (by jsiwek):

 * status:  closed => reopened
 * resolution:  fixed =>


 This seems to make it so that log buffers may be flushed at a frequency
 lower than that of the rotation interval of a remote peer, dependent on
 traffic volume & amount of writes that happen to a given stream.  So for a
 given rotation interval, the remote peer's logs might have none of the
 content actually logged in that interval because it wasn't flushed yet or
 content from previous intervals gets mixed in because the flush was
 delayed too long.

 Does there need to be a negotiation of log flushing around rotation to
 make low volume remote logs always rotate properly?

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/498#comment:4>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list