Implement leftover log rotation/archival for supervised nodes

This helps prevent a node from being killed/crashing in the middle
of writing a log, restarting, and eventually clobbering that log
file that never underwent the rotation/archival process.

The old `archive-log` and `post-terminate` scripts as used by
ZeekControl previously implemented this behavior, but the new logic is
entirely in the ASCII writer.  It uses ".shadow" log files stored
alongside the real log to help detect such scenarios and rotate them
correctly upon the next startup of the Zeek process.
This commit is contained in:
Jon Siwek 2020-06-24 14:28:54 -07:00
parent a46e24091a
commit 11949ce37a
11 changed files with 523 additions and 17 deletions

View file

@ -10,6 +10,8 @@
#include "Desc.h"
#include "zlib.h"
namespace plugin::Zeek_AsciiWriter { class Plugin; }
namespace logging { namespace writer {
class Ascii : public WriterBackend {
@ -35,6 +37,10 @@ protected:
bool DoHeartbeat(double network_time, double current_time) override;
private:
friend class plugin::Zeek_AsciiWriter::Plugin;
static void RotateLeftoverLogs();
bool IsSpecial(const std::string &path) { return path.find("/dev/") == 0; }
bool WriteHeader(const std::string& path);
bool WriteHeaderField(const std::string& key, const std::string& value);