[Bro-Dev] Broker::publish API

Robin Sommer robin at corelight.com
Wed Aug 8 08:54:27 PDT 2018

On Wed, Aug 08, 2018 at 14:20 +0000, Justin Azoff wrote:

> There's also a bunch of places that I think were written standalone first and then updated to work on a cluster in
> place resulting in some awkwardness..

Yeah, indeed, that's another other source of complexity with these

> But if this was written in a more 'cluster by default' way, it would just look like:

Nice example. That's the kind of thing I hope we can do during the
next cycle: streamline the scripts to unify these kinds of logic.

> Broker::publish could possibly be optimized for standalone to raise the event directly if not being ran in a cluster.

Or we generally raise published events locally as well if the node is
subscribed to the destination topic. There are pros and cons for that
I think.


Robin Sommer * Corelight, Inc. * robin at corelight.com * www.corelight.com

More information about the bro-dev mailing list