Hi IntelMQ-Devs,
wondering what an OutputBot should do, if it cannot put an event to the output, because of the event itself.
Should it do something like self.logger.warning("event does not meet criteria for output") self._dump_message() # to place the event in a dump file for later inspection
self.acknowledge_message() ?
Background: the https://github.com/certtools/intelmq/blob/develop/intelmq/bots/outputs/misp/... seems to get events that it cannot insert into MISP, because some fields necessary in the intelmq event are not filled with values.
If the bot detects this, it can skip the event, but it seems a good idea to preserve enough info how the empty values came to be.
The alternatives to dumping would be a) write out the event in the log using self.logger b) just ignore the event
Thanks, Bernhard
Hi,
On 5/14/20 2:02 PM, Bernhard Reiter wrote:
wondering what an OutputBot should do, if it cannot put an event to the output, because of the event itself.
The current (default) behavior is, that if an Output Bot throws an exception, the message is dumped, just like with every other bot.
If the bot detects this, it can skip the event, but it seems a good idea to preserve enough info how the empty values came to be.
The alternatives to dumping would be a) write out the event in the log using self.logger
As we already have the message dumping for this purpose, I'd use the existing mechanism here.
b) just ignore the event
This can be already configured by setting error_dump_message to false
I hope this answers your question.
best regards Sebastian