A doubt regarding RecordVal

Zeek
1

when we say:
conn_val = new RecordVal(connection_type);

How many fields are there in the created record ?

8, since that's how many are defined for the corresponding type in bro.init.

Now after that when we say...
conn_val->Assign(12, new StringVal(tm_string)); or
conn_val->Assign(13, new StringVal(tm_string));

I don't know where you got those lines, but they won't work if you execute
them (follow the code executed by RecordVal::Assign).

Is the size of the record increased dynamically depending on how many
Assigns we make ?

No. You have to manually make sure that your assignments to the record
value in the event engine are consistent with the number of fields *and their
types* as defined in bro.init.

    Vern

2

hi,

It is very advantageous to have mechanism and policy separated
(as mentioned in Bro paper) but does it incur any overhead ?

The paper says: for each event passed to the interpreter,
it retrieves the (semi-) compiled code for the corresponding handler,
binds the values of the events to the arguments of the handler, and
interprets the code.

Would'nt this take some extra time compared to if it was already compiled?
(although the flexibility is lost in the latter case)

thanks a lot
Ashley