6 Nov
2017
6 Nov
'17
3:16 p.m.
Right now, Bro will print scientific notation in JSON logs but we've
always tended to avoid it in the standard Bro log format. What does
everyone think about switching to allow scientific notation in the
standard log format? Daniel recently did some exploration of various
versions of awk and they all support scientific notation (I think that
was part of my concern a long time ago).
Thoughts?
.Seth
--
Seth Hall * Corelight, Inc * www.corelight.com
6 Nov
6 Nov
6:33 p.m.
On Mon, Nov 06, 2017 at 09:16 -0500, you wrote:
versions of awk and they all support scientific
notation
I'm wondering if that's true for other log parsers as well. The main
thing I'd want to avoid is breaking people's existing scripts. We
could make it an option?
Robin
--
Robin Sommer * ICSI/LBNL * robin(a)icir.org * www.icir.org/robin
7:10 p.m.
On 11/6/17 8:16 AM, Seth Hall wrote:
Right now, Bro will print scientific notation in JSON
logs but we've
always tended to avoid it in the standard Bro log format. What does
everyone think about switching to allow scientific notation in the
standard log format? Daniel recently did some exploration of various
versions of awk and they all support scientific notation (I think that
was part of my concern a long time ago).
Thoughts?
.Seth
Actually, right now Bro uses scientific notation in JSON logs only
for very large values (such as 3.1e+15). For values very close to
zero (such as 1.2e-7), Bro will write "0" to a JSON log.
9:03 p.m.
How about a user redef'able format string for doubles in logs? Even more
flexible would be to make it a function. Let the user decide the format
they need, and adapt their scripts accordingly, with the default being the
current behavior.
On Mon, Nov 6, 2017 at 10:10 AM, Daniel Thayer <dnthayer(a)illinois.edu>
wrote:
On 11/6/17 8:16 AM, Seth Hall wrote:
Right now, Bro will print scientific notation in
JSON logs but we've
always tended to avoid it in the standard Bro log format. What does
everyone think about switching to allow scientific notation in the
standard log format? Daniel recently did some exploration of various
versions of awk and they all support scientific notation (I think that
was part of my concern a long time ago).
Thoughts?
.Seth
Actually, right now Bro uses scientific notation in JSON logs only
for very large values (such as 3.1e+15). For values very close to
zero (such as 1.2e-7), Bro will write "0" to a JSON log.
_______________________________________________
bro-dev mailing list
bro-dev(a)bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
7 Nov
7 Nov
3:46 p.m.
On 6 Nov 2017, at 15:03, Jim Mellander wrote:
How about a user redef'able format string for
doubles in logs? Even
more
flexible would be to make it a function. Let the user decide the
format
they need, and adapt their scripts accordingly, with the default being
the
current behavior.
Ah, I like that idea. I think the current logs (both JSON formatted and
normal Bro format) are fine for most people, but for the people that
actually want doubles displayed differently this could give them that
option.
.Seth
--
Seth Hall * Corelight, Inc * www.corelight.com
1652
days inactive
1653
days old
4 comments
4 participants
participants (4)
-
Daniel Thayer -
Jim Mellander -
Robin Sommer -
Seth Hall