[Bro-Dev] Broker::publish API

Jon Siwek jsiwek at corelight.com
Tue Aug 14 08:51:28 PDT 2018


On Tue, Aug 14, 2018 at 10:13 AM Robin Sommer <robin at corelight.com> wrote:

> One more question: what about raising published events locally as well
> if the sending node is subscribed to the topic? I'm kind of torn on
> that. I don't think we want that as a default, but perhaps as an
> option, either with the publish() call or, likely better, with the
> subscribe() call? I can see that being helpful in cases like unifying
> standalone vs cluster operation; and more generally, for running
> multiple node types inside the same Bro instance.

Not sure, is Broker::auto_publish() currently able to do the same thing?

e.g. if I want an event to be raised locally, I raise it via "event"
and it automatically gets published.

I can also see the opposite being intuitive: If I told
Broker::subscribe() to raise locally, then I get just always use
Broker::publish() and not think about the difference between using
"event" versus "publish".  Would Broker::auto_publish() be removable
then?

- Jon


More information about the bro-dev mailing list