[Bro-Dev] Module prefix in sending and receiving Broker events

Matthias Vallentin vallentin at icir.org
Wed Sep 12 08:08:57 PDT 2018


When I receive events from Bro via Broker, they have the prefix of the 
enclosing module:

    module Foo;

    event foo() { ... }
    event bar() { ... }

When I publish "foo" via Broker, it arrives as "Foo::foo". However, when 
I publish an event "Foo::bar" from Broker, Bro doesn't recognize it. I
must published it as "bar" - without the module prefix. Is this 
intentional?

    Matthias


More information about the bro-dev mailing list