[Bro-Dev] Sumstats bugs & fixes

[Jim Mellander]

Seems like either way would work - I've used the idea of keeping a list of
keys to delete after loop exit (not in bro, actually, but in awk, which has
a similar paradigm), but since we're peeling off keys, and discarding them
after usage, avoiding the additional loop seemed more natural/efficient -
although I suppose my way of looping over the keys, just to gather the
first item, and breaking out may not seem too natural or be particularly
efficient.

I'll try your changes to see if they accomplish the same things.  Based on
Justin's post, I'm now more concerned about running my code on a cluster,
but will tackle that next.


On Thu, Jan 18, 2018 at 9:50 AM, Jon Siwek <jsiwek at corelight.com> wrote:

> On Wed, Jan 17, 2018 at 6:30 PM, Jim Mellander <jmellander at lbl.gov> wrote:
>
> > Unfortunately, the reschedule
> > is:
> > schedule 0.01 secs { process_epoch_result(ss, now, data1) };
> > instead of:
> > schedule 0.01 secs { SumStats::process_epoch_result(ss, now, data1) };
> > so it silently fails after the first 50 results.
>
> Thanks, you're right about that.
>
> > Would be nice to have a
> > warning if a script schedules an event that doesn't exist.
>
> Right again, it would be nice since it has resulted in bugs like this,
> though I recall it might not be an easy change to the parser to clear
> up the differences in namespacing rules for event identifiers.
>
> > Attached please find hash_test.bro & (patched) non-cluster.bro
>
> Thanks for those.  I remember you pointing out the potential problem
> in the earlier mail and meant to respond to indicate we should fix it
> and I must have just forgot, so sorry for that.  I had a bit of a
> different idea on how to address the iterator invalidation that might
> be more understandable: keep a separate list of keys to delete later,
> outside the loop.  I have my version of your proposed fixes at [1].
> Can you take a look and let me know if that works for you?
>
> - Jon
>
> [1] https://github.com/bro/bro/commit/3495b2fa9d84e8105a79e24e4e9a2f
> 9181318f1a
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20180118/b85d9fcf/attachment-0001.html