[Discussion] Configuration file conditional preprocessor

Frank Knobbe frank at knobbe.us
Tue Feb 10 22:58:11 UTC 2009


On Tue, 2009-02-10 at 16:05 -0500, Matt Jonkman wrote:
> Agreed, I don't think one config will serve for an entire net. It still
> has to be sensor specific. But hopefully we can make it less complex.

You can ensure that the config uses the "last set option" instead of
throwing an error or using a multiple option. That should allow you to
load a template-based config valid for the whole network (perhaps
http_inspect stuff that's the same across the network), and then loading
sensor specific settings which will override previously configured
template-based defaults so tat you can customize/tweak the settings for
the sensor instance. (We can do that today with variable assignments but
I don't think with other options).

-Frank





More information about the Discussion mailing list