[Bro-Dev] Broker's remote logging (BIT-1784)
seth at icir.org
Wed Feb 1 07:02:45 PST 2017
> On Jan 31, 2017, at 5:41 PM, Robin Sommer <robin at icir.org> wrote:
> For RemoteSerializer, log events and log
> filters run only on the originating nodes; those guys make all
> decisions about what's getting logged exactly and they then send that
> on to the manager, which just writes out the data it receives.
Just to pile onto this, I think it should be this way too. I'd really like to avoid script code executing on the logger.
International Computer Science Institute
(Bro) because everyone has a network
More information about the bro-dev