Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

New test.

Browse source
This commit is contained in:
Robin Sommer 2011-03-10 18:13:17 -08:00
parent 45ebfbb2b8
commit 0f854315e9
2 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/Baseline/logging.empty-event/ssh.log Normal file
View file

@ -0,0 +1,6 @@
# t id.orig_h id.orig_p id.resp_h id.resp_p status country
1299809561.67372 1.2.3.4 1234 2.3.4.5 80 success unknown
1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure US
1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure UK
1299809561.67372 1.2.3.4 1234 2.3.4.5 80 success BR
1299809561.67372 1.2.3.4 1234 2.3.4.5 80 failure MX

33
testing/btest/logging/empty-event.bro Normal file
View file

@ -0,0 +1,33 @@
#
# @TEST-EXEC: bro %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;
export {
redef enum Log::ID += { SSH };
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
country: string &default="unknown";
};
}
global log_ssh: event(rec: Log);
event bro_init()
{
Log::create_stream(SSH, [$columns=Log, $ev=log_ssh]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
}