[IntelMQ-dev] Speed dumping events in bots

Mika Silander mika.silander at csc.fi
Mon May 15 11:40:51 CEST 2023


Hi again,

 Afaik, if handling an event fails in a bot, the default behaviour of a bot is to sleep 15 seconds and then retry processing. If the retry fails, the bot dumps the event and picks the next event from the inqueue. We have a bot where it would be desirable to change this default behaviour so that the dump is done immediately on the first failure. Is there a way to configure a single bot to behave differently from other bots as described? Or will a change in configuration affect the entire bot net?

 If there's no easy way configuring, I guess technically I could implement exceptions to be thrown in those situations where quick dumping is desired and then call the _dump_message(?) method. However, I would prefer to modify as few bots of the official distribution as possible. 

 Comments, pointers to docs, sources or the like are most welcome.

Br, Mika


More information about the IntelMQ-dev mailing list