# known\_\*

**URL:** <https://community.zeek.org/t/known/5782>\
**Category:** Zeek\
**Created:** [July 30, 2019, 8:01am UTC](https://community.zeek.org/t/known/5782 "2019-07-30T08:01:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Palumbo\_Mauro](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)\
**Post date:** [July 30, 2019, 8:01am UTC](https://community.zeek.org/t/known/5782/1 "2019-07-30T08:01:02Z")

</div>

Hi everybody,

there are a number of scripts (known\_services, known\_hosts, known\_certs) which are implemented both using a broker store and sending broker events. It is possible to switch from one mode to the other using the option use\_service\_store.

Is there any particular reason for this? Is one option more efficient than the other?

Thanks,

Mauro

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [July 30, 2019, 4:37pm UTC](https://community.zeek.org/t/known/5782/2 "2019-07-30T16:37:53Z")

</div>

I think it can get kind of confusing with the naming of different functions.

For instance, in bro\_init() you’ll see Cluster::create\_store(), but later you’ll see Broker::put\_unique(). Those are both required bits for the data store to work and the Cluster\* functions use Broker underneath.

The variables like use\_service\_store toggle whether or not to use the data store method for persistent data or if you’d rather just use Cluster::publish\_hrw. I imagine that’s faster because it’s doing less, then then you obviously lose the persistence.

-Dop

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [July 30, 2019, 4:55pm UTC](https://community.zeek.org/t/known/5782/3 "2019-07-30T16:55:21Z")

</div>

> &nbsp;&nbsp;&nbsp;there are a number of scripts (known\_services, known\_hosts, known\_certs) which are implemented both using a broker store and sending broker events. It is possible to switch from one mode to the other using the option use\_service\_store.
> 
> Is there any particular reason for this?

Mostly due to not knowing which version better fits the common use-case.

> Is one option more efficient than the other?

No, there's two choices because there's a trade-off: using the Broker  
store version is theoretically less scalable because it relies on a  
single, centralized node, but the version using events partitions the  
data across many nodes in a consistent way via HRW. With the Broker  
store version you have the option of turning on persistence (e.g.  
saving data across restarts can prevent duplicate logs, etc.). With  
the version using events there's no option for persistence, although  
there's nothing preventing one from combining the two approaches  
except complexity of implementing it right: partitioned events +  
storing data inside a Broker store.

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/known/5782/4 "2022-05-06T15:46:39Z")

</div>