On Tue, Aug 14, 2018 at 10:13 AM Robin Sommer <robin(a)corelight.com> wrote:
One more question: what about raising published events
locally as well
if the sending node is subscribed to the topic? I'm kind of torn on
that. I don't think we want that as a default, but perhaps as an
option, either with the publish() call or, likely better, with the
subscribe() call? I can see that being helpful in cases like unifying
standalone vs cluster operation; and more generally, for running
multiple node types inside the same Bro instance.
Not sure, is Broker::auto_publish() currently able to do the same thing?
e.g. if I want an event to be raised locally, I raise it via "event"
and it automatically gets published.
I can also see the opposite being intuitive: If I told
Broker::subscribe() to raise locally, then I get just always use
Broker::publish() and not think about the difference between using
"event" versus "publish". Would Broker::auto_publish() be removable