[Bro-Dev] Duplicate Notice Actions Regression?

Siwek, Jonathan Luke jsiwek at illinois.edu
Fri Feb 8 14:22:42 PST 2013


>> I also thought that could have broken the notice de-duplication/suppression, but it seemed to work in my testing.  A simple check is to do `broctl print Notice::ordered_policy`
> 
> It's populated on all the nodes.

Then I think that change to using redef to clear Notice::policy isn't working, probably because it depends on @load ordering -- it would always have to be the last script to be loaded that redefs Notice::policy.

Seth said he'll make some changes so that the application of notice policy is better delegated to the manager in a cluster environment.  Can you create a bug ticket for him?

    Jon


More information about the bro-dev mailing list