Re: [Bro-Dev] Writing SumStats plugin

2018-08-13 Thread Jon Siwek
On Tue, Aug 7, 2018 at 5:15 PM Jim Mellander wrote: > Incidentally, I think theres a bug in the observe() function: > > These two lines are run in the loop thru the reducers: >if ( r?$normalize_key ) > key = r$normalize_key(copy(key)); > which has the

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Azoff, Justin S
> On Aug 13, 2018, at 12:24 PM, Jon Siwek wrote: > > Even Newer Worker: > > Broker::publish(Cluster::worker_topic, my_event); > > See any problems there? That's nice and simple :-) Assuming that can send the events around in the most efficient way possible, that's perfect. The one tricky

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jon Siwek
On Mon, Aug 13, 2018 at 8:09 AM Jan Grashöfer wrote: > > On 10/08/18 17:12, Robin Sommer wrote: > > I hear you, but I think I haven't quite understood the concern yet. > > Can you give me an example where the difference matters? What's > > different between publishing intel events to

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jon Siwek
On Fri, Aug 10, 2018 at 11:47 AM Azoff, Justin S wrote: > If relay is removed how does a script writer efficiently get an event from > one worker (or manager) > to all of the other workers? Old Worker: Cluster::relay_rr(Cluster::proxy_pool, my_event); New Worker:

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jan Grashöfer
On 10/08/18 17:12, Robin Sommer wrote: > I hear you, but I think I haven't quite understood the concern yet. > Can you give me an example where the difference matters? What's > different between publishing intel events to bro/cluster/worker/intel > vs bro/cluster/worker if both go to all workers?