On Tue, Feb 07, 2017 at 02:46 +0000, you wrote:
> It was actually always confusing to me that a remote log entry versus > a local log entry would be processed differently regarding the log_* > events. I know, it's a bit confusing. Some of that is historic and part of trying to maintain semantics as things were involving (both logging framework and communication; quite similar actually to what we've been discussing here: what should be done where). It all came out of "remote printing" where a print-statement would just send what it would normally print into a file, over to another node---that means everything was fully procecessed already as it was received. The other part is the performance optimization: special-casing log transmission for batching and volume, so that it doesn't become a bottleneck. Thinking about it as just outgoing entries fits its best I think. Onw the receiving side, the entries don't "really" enter the flu logging framework, they just take a fast path directly into the writers. One thing I'm doing is renaming methods to make that bit clearer; the two Write() methods are clearly misleading. Robin -- Robin Sommer * ICSI/LBNL * ro...@icir.org * www.icir.org/robin _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev