# x = x and &synchronized

**URL:** <https://community.zeek.org/t/x-x-and-synchronized/2648>\
**Category:** Zeek\
**Created:** [April 18, 2013, 4:05pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648 "2013-04-18T16:05:25Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Mandelberg](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@David\_Mandelberg](https://community.zeek.org/u/David_Mandelberg)\
**Post date:** [April 18, 2013, 4:05pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/1 "2013-04-18T16:05:25Z")

</div>

How does the workaround I found in  
[http://tracker.bro.org/bro/ticket/980#comment:1](http://tracker.bro.org/bro/ticket/980#comment:1) interact with  
&synchronized? In the below case, can the last line undo the line before  
it?

node-1\> foo[0]$x += 42;  
node-2\> foo[0]$x += 42;  
node-1\> foo[0] = foo[0];

Alternatively, is there a better workaround or will that bug be fixed  
soon?

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [April 19, 2013, 3:04pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/2 "2013-04-19T15:04:29Z")

</div>

I've been moving away from the &synchronized attribute for quite a while and moving toward manual, explicit data sharing through events. My experience with using it was like you're discovering, there are so many complicated edge cases that we don't even reasonably have a good mechanism of handing well.

At some point we may have better primitives for synchronizing data across nodes easily, but we don't have anything concrete in progress yet.

Just something to think about. 🙂

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![David\_Mandelberg](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@David\_Mandelberg](https://community.zeek.org/u/David_Mandelberg)\
**Post date:** [April 19, 2013, 3:34pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/3 "2013-04-19T15:34:01Z")

</div>

Ok. Can you point me to an example script that does explicit data  
sharing?

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [April 19, 2013, 3:42pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/4 "2013-04-19T15:42:19Z")

</div>

The metrics framework in 2.1 does it. In 2.2 the intel framework and the sumstats framework does it (sumstats is the renamed and expanded metrics framework).

.Seth

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [April 19, 2013, 7:34pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/5 "2013-04-19T19:34:00Z")

</div>

Yes, the 3rd line can undo the 2nd. For more consistency we'd need to  
have some explicit synchronization/locking across nodes, which we  
(deliberately) don't do. &synchronized provides a best-effort  
solution, but it's not great if you need strict semantics.

Robin

---

<div class="post-metadata">

**Author:** ![David\_Mandelberg](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@David\_Mandelberg](https://community.zeek.org/u/David_Mandelberg)\
**Post date:** [April 19, 2013, 7:51pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/6 "2013-04-19T19:51:07Z")

</div>

It is possible to get more consistency without locking if node-1 sends a  
message like "foo[0] = foo[0]" (instead of the "foo[0] = \<data\>" that I  
assume it does now) to all other nodes and they execute that locally.  
This adds complexity that may not be worthwhile though.

Anyway, after the discussion of #981 on bro-dev, I realized that this  
workaround is also generally incorrect. Maybe #980 and #981 should be  
merged since they're caused by the same thing that I initially  
misunderstood?

---

<div class="post-metadata">

**Author:** ![David\_Mandelberg](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@David\_Mandelberg](https://community.zeek.org/u/David_Mandelberg)\
**Post date:** [April 24, 2013, 7:26pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/7 "2013-04-24T19:26:53Z")

</div>

> > Ok. Can you point me to an example script that does explicit data  
> > sharing?
> 
> The metrics framework in 2.1 does it. In 2.2 the intel framework and

the

> sumstats framework does it (sumstats is the renamed and expanded metrics  
> framework).

Just to make sure I'm understanding this correctly, if the name of an  
event (lets call it foo) matches the Cluster::worker2manager\_events  
pattern, then "event foo();" on a worker node will queue up the event  
handlers for foo on both that node and on the manager. Is that right?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/x-x-and-synchronized/2648/8 "2022-05-06T15:40:56Z")

</div>


