[Bro] Updating table in SumStats - not recognized in outer event

Shiran Aizik chegov at gmail.com
Mon Apr 18 07:59:55 PDT 2016


Hello,

I have a global synced table which I update on threshold_crossed in
SumStats.
The update is successful, yet when I try to access this table from a
different event (dns query reply) it is empty.
I work wih bro 2.4.1 in cluster mode. The table is defined as global,
synced and mergable.
My goal is that all workers will send their observations to SumStats and
based on a threshold, update a table for all the workers to know.

Any ideas what can I try ?

Thank you
Chegov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160418/f5135eda/attachment.html 


More information about the Bro mailing list