[Bro] Broker coding question

Mike Dopheide dopheide at gmail.com
Wed May 23 13:54:53 PDT 2018


Maybe jumping the gun a little here, but I've started playing with the new
Broker functions a bit and run into an issue that's probably just lack of
understanding on my part.  I've crafted a policy specific for this
discussion.

Basically, I'm trying to send data from the manager to my workers and it's
not showing up as I'd expect.  In this policy you'll see a couple different
ways I thought were right based on the documentation and looking at other
examples.  One was using Broker::auto_publish so any call to my
'manager_to_workers' event should go out automatically.  The other is a
straight Broker::publish.

When I run this and then check with "broctl print Dop::bourbon", all I ever
see is Eagle Rare, none of the published events appear to make it into the
set.

Thanks,
Dop
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180523/c29dfb58/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: broker-when.bro
Type: application/octet-stream
Size: 877 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180523/c29dfb58/attachment.obj 


More information about the Bro mailing list