Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider removing BroFile cache #375

0xxon opened this issue May 22, 2019 · 0 comments


None yet
1 participant
Copy link

commented May 22, 2019

We could remove the BroFile cache. The cache is a workaround for when many, many files are open - more than Bro is allowed to have open simultaneously (by the operating system, or by the user).

In this case, Zeek closed file descriptors while keeping the BroFile objects around, re-opening the file-descriptors on the next write to the BroFile object.

This seems unnecessary today - and the part of Zeek that interacts most with files (the logging framework) does not use/respect these limits.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.