base/frameworks/logging/writers/dataseries.bro

LogDataSeries

Interface for the DataSeries log writer.

Namespace:LogDataSeries
Source File:/scripts/base/frameworks/logging/writers/dataseries.bro

Summary

Options

LogDataSeries::compression: string &redef Compression to use with the DS output file.
LogDataSeries::dump_schema: bool &redef Should we dump the XML schema we use for this DS file to disk? If yes, the XML schema shares the name of the logfile, but has an XML ending.
LogDataSeries::extent_size: count &redef The extent buffer size.
LogDataSeries::num_threads: count &redef How many threads should DataSeries spawn to perform compression? Note that this dictates the number of threads per log stream.
LogDataSeries::use_integer_for_time: bool &redef Should time be stored as an integer or a double? Storing time as a double leads to possible precision issues and can (significantly) increase the size of the resulting DS log.

Detailed Interface

Options

LogDataSeries::compression
Type:string
Attributes:&redef
Default:"gz"

Compression to use with the DS output file. Options are:

‘none’ – No compression. ‘lzf’ – LZF compression (very quick, but leads to larger output files). ‘lzo’ – LZO compression (very fast decompression times). ‘gz’ – GZIP compression (slower than LZF, but also produces smaller output). ‘bz2’ – BZIP2 compression (slower than GZIP, but also produces smaller output).

LogDataSeries::dump_schema
Type:bool
Attributes:&redef
Default:F

Should we dump the XML schema we use for this DS file to disk? If yes, the XML schema shares the name of the logfile, but has an XML ending.

LogDataSeries::extent_size
Type:count
Attributes:&redef
Default:65536

The extent buffer size. Larger values here lead to better compression and more efficient writes, but also increase the lag between the time events are received and the time they are actually written to disk.

LogDataSeries::num_threads
Type:count
Attributes:&redef
Default:1

How many threads should DataSeries spawn to perform compression? Note that this dictates the number of threads per log stream. If you’re using a lot of streams, you may want to keep this number relatively small.

Default value is 1, which will spawn one thread / stream.

Maximum is 128, minimum is 1.

LogDataSeries::use_integer_for_time
Type:bool
Attributes:&redef
Default:F

Should time be stored as an integer or a double? Storing time as a double leads to possible precision issues and can (significantly) increase the size of the resulting DS log. That said, timestamps stored in double form are consistent with the rest of Bro, including the standard ASCII log. Hence, we use them by default.

Copyright 2013, The Bro Project. Last updated on June 15, 2015. Created using Sphinx 1.2.2.