[Bro-Dev] Duplicate Notice Actions Regression?
Siwek, Jonathan Luke
jsiwek at illinois.edu
Fri Feb 8 14:22:42 PST 2013
>> I also thought that could have broken the notice de-duplication/suppression, but it seemed to work in my testing. A simple check is to do `broctl print Notice::ordered_policy`
>
> It's populated on all the nodes.
Then I think that change to using redef to clear Notice::policy isn't working, probably because it depends on @load ordering -- it would always have to be the last script to be loaded that redefs Notice::policy.
Seth said he'll make some changes so that the application of notice policy is better delegated to the manager in a cluster environment. Can you create a bug ticket for him?
Jon
More information about the bro-dev
mailing list