[Bro-Dev] #498: Efficiency problem with remote log flushing
Bro Tracker
bro at tracker.bro-ids.org
Wed Oct 5 21:50:54 PDT 2011
#498: Efficiency problem with remote log flushing
----------------------+------------------------
Reporter: robin | Owner: robin
Type: Problem | Status: reopened
Priority: Normal | Milestone: Bro1.6
Component: Bro | Version: git/master
Resolution: | Keywords: beta
----------------------+------------------------
Comment (by robin):
On Wed, Oct 05, 2011 at 18:48 -0000, you wrote:
> content from previous intervals gets mixed in because the flush was
> delayed too long.
>
> Does there need to be a negotiation of log flushing around rotation to
> make low volume remote logs always rotate properly?
This would be tricky. The manager would need to delay rotation until
it has received the ack from everybody. That in turn might then cause
other data to be in the wrong log, as the other nodes will keep
sending. Not sure this is really solvable. What we perhaps could do is
forcing a flush like once a second. That would at least limit the
problematic time interval.
Robin
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/498#comment:10>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list