[Bro] Reading data into a table

Damian Gerow damian.gerow at shopify.com
Tue Sep 29 07:22:24 PDT 2015


We've run into a few problems with our scripts and the use of &persistent,
so we're looking to do some home-grown persistence. These scripts are part
of a module called ConnectionValidation; the applicable bits of the scripts
are at https://gist.github.com/mutemule/6076cddce3ce8c9e7013. It's worth
pointing out that the module as a whole is loaded in to all components, but
the persistence layer is only loaded in to the proxy.

What I'm seeing is the table being written to disk as expected during
bro_done(), but seemingly not being read back in during bro_init(): after
startup, the table remains blank in all cluster components.

I'd previously tried this with a set instead of a table, but that didn't
work. Then I tried using events to populate the set, but that also didn't
work. So now I'm on a table, and following the input framework
documentation[0] almost exactly, but it's still not doing what I expected.

What am I doing wrong? How do I read a table in from disk during
initialization/startup?

[0] https://www.bro.org/sphinx/frameworks/input.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150929/229231d1/attachment.html 


More information about the Bro mailing list