[Bro-Dev] design summary: porting Bro scripts to use Broker

Robin Sommer robin at icir.org
Wed Oct 11 07:57:50 PDT 2017



On Mon, Oct 09, 2017 at 19:33 +0000, you wrote:

> It’s just a matter of where you expect most users to feel comfortable
> making customizations: in Bro scripts or in a broctl config file.

True, though I think that applies to much of Bro's configuration, like
the logging for example. Either way, starting with with script-only
customization and then reevaluate later sounds good.

> Maybe the key point is that these customizations only make sense to
> happen once before init time?

Yeah, that's right, changing store attributes afterwards seems
unlikely. From that perspective I get the redef approach. I was more
thinking about consistency with other script APIs. We use redef for
simple tuning (single-value options, timeouts, etc), but less these
days for more complex setups (see logging and input frameworks). I'd
be interested to hear what other people prefer.

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin


More information about the bro-dev mailing list