diff --git a/testing/btest/Baseline/logging.empty-event/ssh.log b/testing/btest/Baseline/logging.empty-event/ssh.log new file mode 100644 index 0000000000..7f21430ea7 --- /dev/null +++ b/testing/btest/Baseline/logging.empty-event/ssh.log @@ -0,0 +1,6 @@ +# t id.orig_h id.orig_p id.resp_h id.resp_p status country +1299809561.67372 1.2.3.4 1234 2.3.4.5 80 success unknown +1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure US +1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure UK +1299809561.67372 1.2.3.4 1234 2.3.4.5 80 success BR +1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure MX diff --git a/testing/btest/logging/empty-event.bro b/testing/btest/logging/empty-event.bro new file mode 100644 index 0000000000..977450b40f --- /dev/null +++ b/testing/btest/logging/empty-event.bro @@ -0,0 +1,33 @@ +# +# @TEST-EXEC: bro %INPUT +# @TEST-EXEC: btest-diff ssh.log + +module SSH; + +export { + redef enum Log::ID += { SSH }; + + type Log: record { + t: time; + id: conn_id; # Will be rolled out into individual columns. + status: string &optional; + country: string &default="unknown"; + }; +} + +global log_ssh: event(rec: Log); + +event bro_init() +{ + Log::create_stream(SSH, [$columns=Log, $ev=log_ssh]); + + local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp]; + + Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]); + Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]); + Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]); + Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]); + Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]); + +} +