[Bro-Dev] #498: Efficiency problem with remote log flushing

Bro Tracker bro at tracker.bro-ids.org
Wed Oct 5 21:50:54 PDT 2011


#498: Efficiency problem with remote log flushing
----------------------+------------------------
  Reporter:  robin    |      Owner:  robin
      Type:  Problem  |     Status:  reopened
  Priority:  Normal   |  Milestone:  Bro1.6
 Component:  Bro      |    Version:  git/master
Resolution:           |   Keywords:  beta
----------------------+------------------------

Comment (by robin):

 On Wed, Oct 05, 2011 at 18:48 -0000, you wrote:

 >  content from previous intervals gets mixed in because the flush was
 >  delayed too long.
 >
 >  Does there need to be a negotiation of log flushing around rotation to
 >  make low volume remote logs always rotate properly?

 This would be tricky. The manager would need to delay rotation until
 it has received the ack from everybody. That in turn might then cause
 other data to be in the wrong log, as the other nodes will keep
 sending. Not sure this is really solvable. What we perhaps could do is
 forcing a flush like once a second. That would at least limit the
 problematic time interval.

 Robin

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/498#comment:10>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list