On 5 Nov 2018, at 11:40, Robin Sommer wrote: > I like the "&log=T|F" syntax to control this more directly, as long as > "&log" remains being equivalent to "&log=T".
Oh, I like that too and it dovetails very nicely with the existing syntax. I remember those discussions we had about &log back then and I remember being the one that pushed for it but even then I didn't feel particularly comfortable with it (as I recall you feeling). .Seth -- Seth Hall * Corelight, Inc * www.corelight.com _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev