Re: [Bro-Dev] "delete" of entire tables/sets

2018-12-06 Thread Vern Paxson
> I believe the clear_table() function still exists in zeek, as well... Hah^2! Yeah, it does. Well, glad I consulted the list before diving into some hacking :-P. Vern ___ bro-dev mailing list bro-dev@bro.org

Re: [Bro-Dev] "delete" of entire tables/sets

2018-12-06 Thread Jim Mellander
I believe the clear_table() function still exists in zeek, as well... On Thu, Dec 6, 2018 at 3:12 PM Vern Paxson wrote: > > I guess re-assigning a new, empty table to the variable could be > > analogous to deleting all entries and also avoids the iterator > > invalidation problem ? > > Hah!,

Re: [Bro-Dev] "delete" of entire tables/sets

2018-12-06 Thread Vern Paxson
> I guess re-assigning a new, empty table to the variable could be > analogous to deleting all entries and also avoids the iterator > invalidation problem ? Hah!, yeah, that's certainly a simple way to do it. Maybe I'll change my hacking for now to just be adding this observation to the "delete"

Re: [Bro-Dev] "delete" of entire tables/sets

2018-12-06 Thread Jon Siwek
On Thu, Dec 6, 2018 at 4:09 PM Vern Paxson wrote: > This means I have to first build up a *separate* vector of all the indexes, > then iterate over that to remove them. I guess re-assigning a new, empty table to the variable could be analogous to deleting all entries and also avoids the

[Bro-Dev] "delete" of entire tables/sets

2018-12-06 Thread Vern Paxson
I'm working on some scripts where I want to remove every element from a table in a single shot. In awk, "delete tbl" would do the trick, but Zeek restricts delete operations to removing single elements. Worse, if I try iterating over an aggregate to remove elements piece-wise, it doesn't remove

Re: [Bro-Dev] Broker cluster discovery and load balancing

2018-12-06 Thread Jon Siwek
On Thu, Dec 6, 2018 at 11:16 AM Hosom, Stephen M wrote: > I have looked at the implementations of publish_hrw and publish_rr in bro. I > could easily implement those features in my application if that is the > recommended way to handle this issue. There's been some ideas on pushing loading

Re: [Bro-Dev] Building bro 2.6 with static broker/caf libraries

2018-12-06 Thread Johanna Amann
FYI - there now also is a topic/johanna/static branch in the base repository, which adds a --enable-static-broker flag that automatically builds/links static broker/caf against Bro. Pull request in https://github.com/zeek/zeek/pull/224. Johanna On Thu, Dec 06, 2018 at 10:25:50AM -0800, Johanna

Re: [Bro-Dev] Building bro 2.6 with static broker/caf libraries

2018-12-06 Thread Philippe Antoine
In case it is helpful, here is the script I used to build all static bro (without any shared libraries) ``` cd bro mkdir buildcaf cd buildcaf cmake -DCAF_NO_UNIT_TESTS=1 -DCAF_NO_EXAMPLES=1 -DCAF_BUILD_STATIC_ONLY=1 ../aux/broker/3rdparty/caf/ make make install || true cd .. mkdir build cd

Re: [Bro-Dev] Building bro 2.6 with static broker/caf libraries

2018-12-06 Thread Johanna Amann
Hi Craig, I pushed another commit to the branch that passes --build-static-only through to CAF; if you just want the patch for that it is available at https://github.com/zeek/broker/commit/bf03a4246113c72d10530cc0c2729a3fa6f0b046. (Note that repositories are currently being migrated; if you pull

[Bro-Dev] Broker cluster discovery and load balancing

2018-12-06 Thread Hosom, Stephen M
I've been working on an application that will fire a large volume of events into bro through broker. Basically, I want to fire events into Broker and load balance them across a pool of workers without the need for more than one worker to handle the same event. I'm having difficulty

Re: [Bro-Dev] Building bro 2.6 with static broker/caf libraries

2018-12-06 Thread Johanna Amann
Hi Craig, I actually recently started working on this, however I am did not quite look at what you want. There already is a branch called topic/johanna/static, which now makes --build-static(-only) work for broker whan CAF is built statically - it does not yet pass the static flags through to

Re: [Bro-Dev] Building bro 2.6 with static broker/caf libraries

2018-12-06 Thread Robin Sommer
On Wed, Dec 05, 2018 at 19:03 -0800, Craig Leres wrote: > (I'm working on updating the FreeBSD port to 2.6 and can't install > things like libcaf_io.so in /usr/local/lib because they conflict with > libraries potentially installed by the devel/caf port.) What's the version of the CAF port?

Re: [Bro-Dev] Building bro 2.6 with static broker/caf libraries

2018-12-06 Thread Seth Hall
Johanna has been working on this recently. We may end up needing to do a minor release update just to fix this because it appears that it's going to be a bit of a packaging problem on a number of OSs and distros otherwise. .Seth On 5 Dec 2018, at 22:03, Craig Leres wrote: > I've read up