[Bro] - large double are not printed/written correctly

[Daniel Thayer]

When you want to print "double" values with the "print" statement,
you can always choose your preferred format with the "fmt" built-in
function.

However, there is no way (that I'm aware of) to specify a format for
"double" values written to a log file.  The current behavior appears to
be broken (because very large or small values cannot be represented in
the logs), so the only workaround would probably be to log as a string.


On 11/2/17 7:15 AM, william de ping wrote:
> Hi,
> 
> Yes, it seems that bro logging and writing large\small numbers is 
> rounded up\down.
> 
> I cannot find any workaround besides printing it as a string (which is 
> not a good approach).
> 
> Any suggestions ?
> 
> Thanks
> B
> 
> On Mon, Oct 30, 2017 at 4:47 PM, Seth Hall <seth at corelight.com 
> <mailto:seth at corelight.com>> wrote:
> 
>     If you are talking about logging through the logging framework, then
>     that's a different code path for value serialization (I think we try
>     and avoid scientific notation there).  Generally just allowing Bro
>     to serialize values how ever it feels like it as you are doing with
>     the bare unformatted print statement can occasionally result in some
>     undesirable behavior.
> 
>     Are you talking about having this trouble with the logging framework?
> 
>        .Seth
> 
> 
> 
>     On 29 Oct 2017, at 10:20, william de ping wrote:
> 
>         Hi,
> 
>         I have this simple script :
> 
>         event bro_init()
>         {
>         local a=-3.019159e-8;
>         print "a",a;
>         local s=fmt("%e",a);
>         print "s",s;
>         }
> 
>         results :
>         a, -0
>         s, -3.019159e-08
> 
>         the printing of variable a is important because its -0 once
>         written in a
>         log file.
> 
>         is there anyway of printing\writing large doubles ?
> 
>         Thanks
>         B
>         _______________________________________________
>         Bro mailing list
>         bro at bro-ids.org <mailto:bro at bro-ids.org>
>         http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>         <https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.ICSI.Berkeley.EDU_mailman_listinfo_bro&d=DwMFaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=Bi5qPBnY0NmYPqnRTPj_AfXQKpfQTZUpCzpfFBcawv0&m=t1WmmPaQy0vN_UfB578UX2RnXTIKO78_t4pI6zG6i1s&s=WyplhHwnKERpszF6HU-MBPsMzVmScwpIuqHa8-7Bxng&e=>
> 
> 
>     --
>     Seth Hall * Corelight, Inc * www.corelight.com
>     <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.corelight.com&d=DwMFaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=Bi5qPBnY0NmYPqnRTPj_AfXQKpfQTZUpCzpfFBcawv0&m=t1WmmPaQy0vN_UfB578UX2RnXTIKO78_t4pI6zG6i1s&s=Z_dO3CiDvaO3DH5fSGqgXqG1UYq5JCclJ8taMigqAaA&e=>
> 
> 
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>