[Bro-Dev] [JIRA] (BIT-1435) &read_expire does not work for embedded table
Robin Sommer (JIRA)
jira at bro-tracker.atlassian.net
Fri Jul 10 08:04:01 PDT 2015
[ https://bro-tracker.atlassian.net/browse/BIT-1435?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=21205#comment-21205 ]
Robin Sommer commented on BIT-1435:
-----------------------------------
If I remember right, there's a problem with the expire attribute not
transferring over in such cases. See if something like this works:
event bro_init()
{
local t: table[string] of string &read_expire=1sec;
level2_table["t1"] = t;
[...]
}
> &read_expire does not work for embedded table
> ---------------------------------------------
>
> Key: BIT-1435
> URL: https://bro-tracker.atlassian.net/browse/BIT-1435
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: git/master
> Reporter: Liang Zhu
> Fix For: 2.5
>
>
> I have a script read_expire_test.bro containing:
> {noformat}
> type embedded_table: table[string] of string &read_expire=1sec;
> global level2_table: table[string] of embedded_table;
> global level1_table: table[string] of string &read_expire=1sec;
> event bro_init()
> {
> level2_table["t1"] = table();
> level2_table["t1"]["t2"] = "t2";
> level1_table["t"] = "t";
> print "level2_table:";
> print level2_table;
> print "level1_table:";
> print level1_table;
> }
> event bro_done()
> {
> print "----------------";
> print "level2_table:";
> print level2_table;
> print "level1_table:";
> print level1_table;
> }
> {noformat}
> If I run this script through some trace (just to delay some time and let timeout work),
> for example,
> {noformat}
> bro --pseudo-realtime -C -r test.pcap read_expire_test.bro
> {noformat}
> the level1_table is cleaned up as expected. However, the embedded table in level2_table is not cleaned up. By running the script, bro does not give any error message or warning, so I assume &read_expire in the following statement
> {noformat}
> type embedded_table: table[string] of string &read_expire=1sec;
> {noformat}
> is supposed to work?
--
This message was sent by Atlassian JIRA
(v6.5-OD-08-001#65007)
More information about the bro-dev
mailing list