mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Logging framework update and mass Log::ID renaming.
- Log path's are generated in the scripting land now. The default Log stream ID to path string mapping works like this: - Notice::LOG -> "notice" - Notice::POLICY_LOG -> "notice_policy" - TestModule::LOG -> "test_module" - Logging streams updated across all of the shipped scripts to be more user friendly. Instead of the logging stream ID HTTP::HTTP, we now have HTTP::LOG, etc. - The priorities on some bro_init handlers have been adjusted to make the process of applying filters or disabling streams easier for users.
This commit is contained in:
parent
fe53091cd1
commit
11c437faa3
77 changed files with 391 additions and 619 deletions
|
@ -3,7 +3,7 @@
|
|||
module DNS;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { DNS };
|
||||
redef enum Log::ID += { LOG };
|
||||
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
|
@ -77,7 +77,7 @@ redef dpd_config += { [ANALYZER_DNS_TCP_BINPAC] = [$ports = dns_tcp_ports] };
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(DNS, [$columns=Info, $ev=log_dns]);
|
||||
Log::create_stream(DNS::LOG, [$columns=Info, $ev=log_dns]);
|
||||
}
|
||||
|
||||
function new_session(c: connection, trans_id: count): Info
|
||||
|
@ -163,7 +163,7 @@ event do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string) &pri
|
|||
{
|
||||
if ( c$dns$ready )
|
||||
{
|
||||
Log::write(DNS, c$dns);
|
||||
Log::write(DNS::LOG, c$dns);
|
||||
add c$dns_state$finished_answers[c$dns$trans_id];
|
||||
# This record is logged and no longer pending.
|
||||
delete c$dns_state$pending[c$dns$trans_id];
|
||||
|
@ -275,6 +275,6 @@ event connection_state_remove(c: connection) &priority=-5
|
|||
# If Bro is expiring state, we should go ahead and log all unlogged
|
||||
# request/response pairs now.
|
||||
for ( trans_id in c$dns_state$pending )
|
||||
Log::write(DNS, c$dns_state$pending[trans_id]);
|
||||
Log::write(DNS::LOG, c$dns_state$pending[trans_id]);
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue