Re: [Bro-Dev] Configurable _expire interval

2016-06-17 Thread Jan Grashöfer
> That must have been me. :-) I need to look at that for a bit to see if > I can remember my reasoning from many years ago (which might very well > have been flawed!). Please file a ticket with your thoughts and assign > it to me. Thanks, I have created BIT-1631 but couldn't assign it to you.

Re: [Bro-Dev] Configurable _expire interval

2016-06-17 Thread Robin Sommer
On Tue, Jun 14, 2016 at 02:35 +0200, you wrote: > The thing is I don't get why reads only need to be propagated once per > (half) _expire interval > Seems someone put some thought into this so maybe I miss something > here :) That must have been me. :-) I need to look at that for a bit to see

Re: [Bro-Dev] Configurable _expire interval

2016-06-13 Thread Jan Grashöfer
>> A side note: I suspect that the table syncing did and still does not >> work as reliable as one would expect. But according to Johanna this will >> become deprecated soon, so I did not touch that code. > > If there's any obvious problem, we should still take a look, but more > generally: yeah

Re: [Bro-Dev] Configurable _expire interval

2016-06-13 Thread Robin Sommer
On Mon, Jun 13, 2016 at 21:41 +0200, you wrote: > A side note: I suspect that the table syncing did and still does not > work as reliable as one would expect. But according to Johanna this will > become deprecated soon, so I did not touch that code. If there's any obvious problem, we should

Re: [Bro-Dev] Configurable _expire interval

2016-06-11 Thread Robin Sommer
On Sat, Jun 11, 2016 at 15:36 +0200, you wrote: > I will have a look. If I am able to fix this I will include this in the > pull request for the intel updates. Please create a separate pull request for this one first (you can merge it into the intel update branch, that'll be fine). >

Re: [Bro-Dev] Configurable _expire interval

2016-06-11 Thread Jan Grashöfer
> I'd call this a bug actually. Redefs are supposed to take effect > before anything else, so having the timeout use the original value > here seems quite wrong. I agree that the behavior is at least counterintuitive :) > My immediate thought (without looking at the code) would be delaying >

Re: [Bro-Dev] Configurable _expire interval

2016-06-10 Thread Aashish Sharma
HI Jan, > > A solution could be to evaluate the interval expression every time it is > > used inside the table implementation. The drawback would be that there For all of my needs above has worked fairly well. including using exp_val= 0 secs as default. Based on the value of item in the

Re: [Bro-Dev] Configurable _expire interval

2016-06-10 Thread Jan Grashöfer
As there was no feedback, I decided to use a bif (see https://github.com/bro/bro/commit/16b1032beeaaf681763785ddac1eed4128430965). It might not be the cleanest solution with respect to the bro language but it is a straight forward approach. ___ bro-dev

Re: [Bro-Dev] Configurable _expire interval

2016-06-08 Thread Jan Grashöfer
My explanations might be hard to follow without examples. So I am adding some pseudo code: > I ran into an issue while trying to make the _expire interval > configurable: Using a redefable constant does not work here, as the > expression only gets evaluated when the table is initialized and thus

[Bro-Dev] Configurable _expire interval

2016-05-26 Thread Jan Grashöfer
Hi, I ran into an issue while trying to make the _expire interval configurable: Using a redefable constant does not work here, as the expression only gets evaluated when the table is initialized and thus later redefs do not influence the value. I thought about circumventing this by setting the