> type embedded_table: table[string] of string &read_expire=1sec; > global level2_table: table[string] of embedded_table; > global level1_table: table[string] of string &read_expire=1sec;
If I remember right, there's a problem with the expire attribute not transferring over in such cases. See if something like this works: event bro_init() { local t: table[string] of string &read_expire=1sec; level2_table["t1"] = t; [...] } _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev