[ https://bro-tracker.atlassian.net/browse/BIT-1435?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Johanna Amann updated BIT-1435: ------------------------------- Fix Version/s: 2.5 > &read_expire does not work for embedded table > --------------------------------------------- > > Key: BIT-1435 > URL: https://bro-tracker.atlassian.net/browse/BIT-1435 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: git/master > Reporter: Liang Zhu > Fix For: 2.5 > > > I have a script read_expire_test.bro containing: > {noformat} > type embedded_table: table[string] of string &read_expire=1sec; > global level2_table: table[string] of embedded_table; > global level1_table: table[string] of string &read_expire=1sec; > event bro_init() > { > level2_table["t1"] = table(); > level2_table["t1"]["t2"] = "t2"; > level1_table["t"] = "t"; > print "level2_table:"; > print level2_table; > print "level1_table:"; > print level1_table; > } > event bro_done() > { > print "----------------"; > print "level2_table:"; > print level2_table; > print "level1_table:"; > print level1_table; > } > {noformat} > If I run this script through some trace (just to delay some time and let > timeout work), > for example, > {noformat} > bro --pseudo-realtime -C -r test.pcap read_expire_test.bro > {noformat} > the level1_table is cleaned up as expected. However, the embedded table in > level2_table is not cleaned up. By running the script, bro does not give any > error message or warning, so I assume &read_expire in the following statement > {noformat} > type embedded_table: table[string] of string &read_expire=1sec; > {noformat} > is supposed to work? -- This message was sent by Atlassian JIRA (v6.5-OD-08-001#65007) _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev