[Bro-Dev] Broker's remote logging (BIT-1784)

Robin Sommer robin at icir.org
Tue Jan 31 20:05:02 PST 2017



On Tue, Jan 31, 2017 at 18:44 -0800, you wrote:

> Purely from an API perspective, could we just move the call from one
> Write() function to the other?

I think the answer is yes, but I've looked at bit more at the code and
I think I see where the challenge is: that 2nd Write() method (the one
the RemoteSerializer is using to output already filtered logs) takes
threading::Values, not Vals. That means switching over from one
Write() to the other isn't straight-forward because we don't have code
that sends threading::Values over the Broker connection. We could
convert the Val's into threading::Values once received, but that'd be
kind of odd:: I'm pretty sure the distinction was due to
threading::Values being quite a bit more efficient to send.

It should be pretty straight-forward to add the necessary 
threading::Value-to-Broker conversion code (just a bit tedious :).
I'll look into that.

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin


More information about the bro-dev mailing list