mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
![]() This could, for example, result in duplicate emails being sent (one from manager and one from worker) if Notice::emailed_types is redef'd in local.bro (or any script that gets loaded on all cluster nodes). The problem was that Notice::policy is used to populate the internal Notice::ordered_policy vector in a priority 10 bro_init handler (in scripts/base/frameworks/notice/main.bro) and then that is what is used when applying policy to notices. In order for scripts/base/frameworks/notice/cluster.bro to prevent Notice::policy from being used on non-manager nodes, it needs to clear it in a bro_init hander of higher priority than 10. |
||
---|---|---|
.. | ||
cluster | ||
communication | ||
control | ||
dpd | ||
input | ||
intel | ||
logging | ||
metrics | ||
notice | ||
packet-filter | ||
reporter | ||
signatures | ||
software | ||
tunnels |