[Bro-Dev] Broker's remote logging (BIT-1784)

[Robin Sommer]

On Tue, Feb 07, 2017 at 02:46 +0000, you wrote:

> It was actually always confusing to me that a remote log entry versus
> a local log entry would be processed differently regarding the log_*
> events.

I know, it's a bit confusing. Some of that is historic and part of
trying to maintain semantics as things were involving (both logging
framework and communication; quite similar actually to what we've been
discussing here: what should be done where). It all came out of
"remote printing" where a print-statement would just send what it
would normally print into a file, over to another node---that means
everything was fully procecessed already as it was received. The other
part is the performance optimization: special-casing log transmission
for batching and volume, so that it doesn't become a bottleneck.

Thinking about it as just outgoing entries fits its best I think. Onw
the receiving side, the entries don't "really" enter the flu logging
framework, they just take a fast path directly into the writers. One
thing I'm doing is renaming methods to make that bit clearer; the two
Write() methods are clearly misleading.

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin