[Bro] BRO and SQL

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon Oct 29 08:03:00 PDT 2012


> Seth's information on "broctl update", reproduced below has proven useful to us when changing const variables (sounds like a contradiction!), such as maintanance of whitelists or blacklists, without restarting bro.  I've been thinking about some use cases of redef'ing consts, where I would like to cook the data in the consts.  This I typically do with a bro_init event handler when bro starts up.  Is there some way to trigger an event when these updates occur, so that the updated variable can be recooked?

A general event called "Control::configuration_update" gets queued when a nodes configuration gets changed by e.g. `broctl update`.  So handling that I think should be an indication that the node's redef'able consts may have changed.  Maybe that will work for what you want to do?

    Jon



More information about the Bro mailing list