From 73954bca27b44ce316ab6bd817b8a8a498efafe7 Mon Sep 17 00:00:00 2001
From: Justin Azoff <justin@corelight.com>
Date: Wed, 27 Mar 2019 11:02:27 -0400
Subject: [PATCH] Reduce weird-stats overhead

observe_weird_stats only needs to be called when cluster_ss_request is
called for the weirds.statistics stat, not for all of them.
---
 scripts/policy/misc/weird-stats.bro | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/policy/misc/weird-stats.bro b/scripts/policy/misc/weird-stats.bro
index 50e29dd010..ac0914d531 100644
--- a/scripts/policy/misc/weird-stats.bro
+++ b/scripts/policy/misc/weird-stats.bro
@@ -84,6 +84,8 @@ function observe_weird_stats()
 # less synchronized?
 event SumStats::cluster_ss_request(uid: string, ss_name: string, cleanup: bool) &priority=10
 	{
+	if ( ss_name != "weirds.statistics" )
+		return;
 	observe_weird_stats();
 	}