[Zeek-Dev] support for event handlers using a subset of parameters

Robin Sommer robin at corelight.com
Fri Feb 1 08:24:22 PST 2019

On Thu, Jan 31, 2019 at 16:29 -0800, Vern Paxson wrote:

> >     global my_event: event(a: count, b: string);
> >     event my_event(b: string)
> >         { print "my_event", b; }

> Is there a compelling use-case that's motivating this change?

I'm sure the main use case is changing an existing event's parameters
without breaking existing scripts -- someting we've been increasingly
running into as a major challenge.

It's a nice a idea to relax parameter passing to work by name, and
allow subsets. However, I can't quite get myself to really like it in
this form, because it *looks* like an error to not have matching
argument lists. Is there some syntax that would make it more clear 
what's going on?


Robin Sommer * Corelight, Inc. * robin at corelight.com * www.corelight.com

More information about the zeek-dev mailing list