I'm not exactly sure of all the impacts of scheduling events. Are there any known issues with scheduling very large numbers of them?
I know there could be the issue of memory exhaustion if you are creating references to large data structures, but assuming that I'm passing reasonably small data structures into events is it reasonable to create something on the order of 100,000 scheduled timers that expire at various times over a three hour interval? Could that cause any performance or resource exhaustion problems?
Generally, timers are quite efficient, note that there's already at
least one per connection internally. Never tried to create huge
numbers on the scripting layer but I would think it should work
reasonably well. I think more important than the sheer number is the
churn rate: if you reinstall zillions of timers every few seconds, it
gets expensive. Also, Bro limits the numbers of timers it expires at
once, so there could be a backlog accumulating if too many fire
Standard disclaimer: I don't dare to make performance predictions
about Bro anymore without actually trying it.