Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
Consider removing BroFile cache #375
We could remove the BroFile cache. The cache is a workaround for when many, many files are open - more than Bro is allowed to have open simultaneously (by the operating system, or by the user).
In this case, Zeek closed file descriptors while keeping the BroFile objects around, re-opening the file-descriptors on the next write to the BroFile object.
This seems unnecessary today - and the part of Zeek that interacts most with files (the logging framework) does not use/respect these limits.