[Bro] SQL usage in Bro

Vern Paxson vern at icir.org
Sun Feb 14 10:25:50 PST 2010


> the top of my head now...
> 
> function new_bad_url(val: string)
> 	{
> 	event db_log("bad_urls", [$url=val]);
> 	}
> global bad_urls: set[string] &add_func=new_bad_url;
> 
> Alternatively, that could be written as:
> global bad_urls: set[string] &add_func=function(val: string) { event  
> db_log("bad_urls", [$url=val]); };

Yeah, that was just the approach I was thinking of too while catching
up on this thread.  (Well, maybe tweaked slightly so that the &add_func
function returns the value to *actually* put in the set, if any.)

		Vern



More information about the Bro mailing list