mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 05:28:20 +00:00
Merge remote-tracking branch 'origin/topic/seth/log-framework-ext'
* origin/topic/seth/log-framework-ext: Log extensions: series of small fixes and new tests. Change the function for log extension to take a path only and update tests. Final changes to log framework ext code. Add logging framework metadata mechanism. Add unrolling separator & field name map to logging framework.
This commit is contained in:
commit
0e44b91cd9
24 changed files with 882 additions and 292 deletions
|
@ -0,0 +1,37 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
type InnerRecord: record {
|
||||
a: count;
|
||||
b: count;
|
||||
c: count;
|
||||
};
|
||||
|
||||
type InnerLoggedRecord: record {
|
||||
a: count &log;
|
||||
b: count;
|
||||
c: count &log;
|
||||
d: set[count] &log;
|
||||
};
|
||||
|
||||
type Extension: record {
|
||||
write_ts: time &log;
|
||||
stream: string &log;
|
||||
inner: InnerRecord;
|
||||
innerLogged: InnerLoggedRecord &log;
|
||||
system_name: string &log;
|
||||
};
|
||||
|
||||
function add_extension(path: string): Extension
|
||||
{
|
||||
return Extension($write_ts = network_time(),
|
||||
$stream = path,
|
||||
$system_name = peer_description,
|
||||
$inner = InnerRecord($a=1,$b=2,$c=3),
|
||||
$innerLogged = InnerLoggedRecord($a=1,$b=2,$c=3,$d=set(1,2,3,4))
|
||||
);
|
||||
}
|
||||
|
||||
redef Log::default_ext_func = add_extension;
|
|
@ -0,0 +1,17 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/http/get.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff .stderr
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
type Extension: record {
|
||||
write_ts: time &log;
|
||||
stream: string &log;
|
||||
system_name: string &log;
|
||||
};
|
||||
|
||||
function add_extension(path: string): Extension
|
||||
{
|
||||
}
|
||||
|
||||
redef Log::default_ext_func = add_extension;
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
type Extension: record {
|
||||
write_ts: time &log;
|
||||
stream: string;
|
||||
system_name: string &log &optional;
|
||||
undefined_string: string &log &optional;
|
||||
};
|
||||
|
||||
function add_extension(path: string): Extension
|
||||
{
|
||||
return Extension($write_ts = network_time(),
|
||||
$stream = path,
|
||||
$system_name = peer_description);
|
||||
}
|
||||
|
||||
redef Log::default_ext_func = add_extension;
|
|
@ -0,0 +1,22 @@
|
|||
# @TEST-EXEC-FAIL: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
type Extension: record {
|
||||
write_ts: time &log;
|
||||
stream: string &log;
|
||||
tab: table[count] of count &log;
|
||||
system_name: string &log;
|
||||
};
|
||||
|
||||
function add_extension(path: string): Extension
|
||||
{
|
||||
return Extension($write_ts = network_time(),
|
||||
$stream = path,
|
||||
$system_name = peer_description,
|
||||
$tab = { [1] = 2, [2] = 3}
|
||||
);
|
||||
}
|
||||
|
||||
redef Log::default_ext_func = add_extension;
|
|
@ -0,0 +1,19 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
type Extension: record {
|
||||
write_ts: time &log;
|
||||
stream: string &log;
|
||||
system_name: string &log;
|
||||
};
|
||||
|
||||
function add_extension(path: string): Extension
|
||||
{
|
||||
return Extension($write_ts = network_time(),
|
||||
$stream = path,
|
||||
$system_name = peer_description);
|
||||
}
|
||||
|
||||
redef Log::default_ext_func = add_extension;
|
|
@ -0,0 +1,11 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
redef Log::default_field_name_map = {
|
||||
["id.orig_h"] = "src",
|
||||
["id.orig_p"] = "src_port",
|
||||
["id.resp_h"] = "dst",
|
||||
["id.resp_p"] = "dst_port",
|
||||
};
|
|
@ -0,0 +1,6 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
redef Log::default_scope_sep = "_";
|
|
@ -0,0 +1,15 @@
|
|||
# This tests the order in which the unrolling and field name
|
||||
# renaming occurs.
|
||||
|
||||
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
redef Log::default_scope_sep = "*";
|
||||
redef Log::default_field_name_map = {
|
||||
["id*orig_h"] = "src",
|
||||
["id*orig_p"] = "src_port",
|
||||
["id*resp_h"] = "dst",
|
||||
["id*resp_p"] = "dst_port",
|
||||
};
|
Loading…
Add table
Add a link
Reference in a new issue