[Bro] SQL usage in Bro
Vern Paxson
vern at icir.org
Sun Feb 14 10:25:50 PST 2010
> the top of my head now...
>
> function new_bad_url(val: string)
> {
> event db_log("bad_urls", [$url=val]);
> }
> global bad_urls: set[string] &add_func=new_bad_url;
>
> Alternatively, that could be written as:
> global bad_urls: set[string] &add_func=function(val: string) { event
> db_log("bad_urls", [$url=val]); };
Yeah, that was just the approach I was thinking of too while catching
up on this thread. (Well, maybe tweaked slightly so that the &add_func
function returns the value to *actually* put in the set, if any.)
Vern
More information about the Bro
mailing list