[Bro] Using the &persistent attribute

Lamps, Jereme jlamps at sandia.gov
Mon Jan 22 06:17:14 PST 2018


I am a little confused as to how this attribute will work. Ideally I would like a state table that persists across numerous iterations of stopping/starting bro (broctl deploy).
To get this to work do I simply need the &persistent attribute and Bro magically handles the rest?
Or do I also need to use the functions checkpoint_state() (in bro_done) with rescan_state (in bro_init) to load the tables?

Best,

Jereme
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180122/575a1fa6/attachment.html 


More information about the Bro mailing list