[Bro] how to get the oldest entry out of table

[Christoph Göldi]

hi

> > is it possible to get the oldest entry out of a table?
>
> For tables, I do not see a way other than iterating over all
> entries. But perhaps you can use a combination of tables and
> vectors; something like
>
>          type entry: record {
>               t: time;
>               c: count;
>          };
>
>          global test: table[addr] of vector of entry;
>
> Then you can keep the vector entries sorted by time.

is vector a new type which is not documented in the bro ref manual?
however, what you suggest doesn't solve my problem, because i have no
chance to expire and delete each entry in the table individually. i can only
delete all entries of one addr at the same time with the expire
attribut for tables.

thanx
christoph