[Bro] disable_stream vs remove_filter
Seth Hall
seth at icir.org
Wed Jun 17 22:10:17 PDT 2015
> On Jun 8, 2015, at 10:01 AM, Adam Hall <abhall1 at yahoo.com> wrote:
>
> 1) Will one give me a performance gain over the other?
Probably nothing noticeable.
> 2) Will one cause problems for other calls being made (If I disable_stream and something calls that stream will it break)?
Nope, no problems.
> 3) If I disable a stream and later decide to add a new filter, will that work?
I’m having trouble remembering, but logging settings may not all be changeable at runtime. I’m actually curious which settings are possible at runtime. I assume you were talking about changes during runtime?
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150618/7e963f05/attachment.bin
More information about the Bro
mailing list