[Bro-Dev] Broker::publish API

Jon Siwek jsiwek at corelight.com
Mon Aug 13 09:24:37 PDT 2018

On Fri, Aug 10, 2018 at 11:47 AM Azoff, Justin S <jazoff at illinois.edu> wrote:

> If relay is removed how does a script writer efficiently get an event from one worker (or manager)
> to all of the other workers?

Old Worker:

  Cluster::relay_rr(Cluster::proxy_pool, my_event);

New Worker:

  Broker::publish(Cluster::rr_topic(Cluster::proxy_pool), my_event);

New Proxy:

  event my_event() { Broker::publish(Cluster::worker_topic, my_event); }

So the proxy has additional overhead of the proxy's event handler.  I
doubt that's much a problem from the "efficiency" standpoint, but if
it were, then just having more proxies helps.  Once real routing were
available the code would still work or you could opt to change to

Even Newer Worker:

  Broker::publish(Cluster::worker_topic, my_event);

See any problems there?

- Jon

More information about the bro-dev mailing list