[Bro-Dev] can I send an opaque of bloomfilter over Cluster::manager2worker_event ?

[Aashish Sharma]

>     const global_hash_seed: string = "" &redef;

Yes, with setting of global_hash_seed, bloomfilter movement across workers is working fine and as expected, I see from initial tests. 

While we are on this thread, is the following good or there is a better way to copy/merge bloomfilter once its sent to workers:

@if (( Cluster::is_enabled() && Cluster::local_node_type() != Cluster::MANAGER ) || !Cluster::is_enabled())

event Blacklist::m_w_add_bloom(val: opaque of bloomfilter)
{
        blacklistbloom=bloomfilter_merge(val, val);

}
@endif 

I figured merging same bloom to itself won't make a difference, I primarily want to copy it to blacklistbloom. 

Aashish 

On Mon, May 01, 2017 at 08:39:03AM -0700, Robin Sommer wrote:
> 
> 
> On Mon, May 01, 2017 at 08:20 -0700, you wrote:
> 
> > Actually - I am not sure if we ever implemented consistent hashing over the
> > cluster;
> 
> Ah, good point, we did implement that, but it needs to be configured:
> 
>     ## Seed for hashes computed internally for probabilistic data structures. Using
>     ## the same value here will make the hashes compatible between independent Bro
>     q## instances. If left unset, Bro will use a temporary local seed.
>     const global_hash_seed: string = "" &redef;
> 
> Robin
> 
> --
> Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin