[Bro-Dev] Broker::publish API
jsiwek at corelight.com
Fri Aug 3 13:57:07 PDT 2018
On Fri, Aug 3, 2018 at 12:22 PM Robin Sommer <robin at corelight.com> wrote:
> On Fri, Jul 27, 2018 at 10:39 -0700, I wrote:
> > Broker::relay(change_topic, change_topic, Config::cluster_set_option, ID, val, location);
> Can somebody remind me what the use-case is for changing the topic on
> relay? Grepping over our standard scripts, I see only one use of
> relay(), and that's the one above.
Another use is hidden within Cluster::relay_rr():
event Intel::new_item(item: Item) &priority=5
if ( Cluster::proxy_pool$alive_count == 0 )
Broker::publish(indicator_topic, Intel::insert_indicator, item);
indicator_topic, Intel::insert_indicator, item);
That is, if the manager is currently connected to some proxy, it picks
one to do the work of distributing the event to workers. Manager
sends 1 message instead of N.
I don't know if there's currently other use-cases for Broker::relay
specifically, but Cluster::relay_rr/Cluster::relay_hrw is essentially
an extension of that which just also does the work of choosing the
initial topic based upon a given pool and partition strategy.
Might have been Justin who originally pointed out potential for
avoiding manager overload in this way.
More information about the bro-dev