Logging framework update and mass Log::ID renaming.

- Log path's are generated in the scripting land
  now.  The default Log stream ID to path string
  mapping works like this:
    - Notice::LOG -> "notice"
    - Notice::POLICY_LOG -> "notice_policy"
    - TestModule::LOG -> "test_module"

- Logging streams updated across all of the shipped
  scripts to be more user friendly.  Instead of
  the logging stream ID HTTP::HTTP, we now have
  HTTP::LOG, etc.

- The priorities on some bro_init handlers have
  been adjusted to make the process of applying
  filters or disabling streams easier for users.

doc/scripts/DocSourcesList.cmake

@@ -66,10 +66,6 @@ rest_target(${psd} base/protocols/http/partial-content.bro)
 rest_target(${psd} base/protocols/http/utils.bro)
 rest_target(${psd} base/protocols/irc/dcc-send.bro)
 rest_target(${psd} base/protocols/irc/main.bro)
-rest_target(${psd} base/protocols/mime/file-extract.bro)
-rest_target(${psd} base/protocols/mime/file-hash.bro)
-rest_target(${psd} base/protocols/mime/file-ident.bro)
-rest_target(${psd} base/protocols/mime/main.bro)
 rest_target(${psd} base/protocols/rpc/main.bro)
 rest_target(${psd} base/protocols/smtp/entities-excerpt.bro)
 rest_target(${psd} base/protocols/smtp/entities.bro)

doc/scripts/example.bro

@@ -80,7 +80,7 @@ redef enum Notice::Type += {
 # Comments of the "##" form can be use to further document it, but it's
 # better to do all documentation related to logging in the summary section
 # as is shown above.
-redef enum Log::ID += { EXAMPLE };
+redef enum Log::ID += { LOG };
 
 # Anything declared in the export section will show up in the rendered
 # documentation's "public interface" section
@@ -218,8 +218,8 @@ type PrivateRecord: record {
 
 event bro_init()
     {
-    Log::create_stream(EXAMPLE, [$columns=Info, $ev=log_example]);
+    Log::create_stream(Example::LOG, [$columns=Info, $ev=log_example]);
-    Log::add_filter(EXAMPLE, [
+    Log::add_filter(Example::LOG, [
         $name="example-filter",
         $path="example-filter",
         $pred=filter_func,

scripts/base/frameworks/cluster/main.bro

@@ -3,7 +3,8 @@
 module Cluster;
 
 export {
-	redef enum Log::ID += { CLUSTER };
+	redef enum Log::ID += { LOG };
+	
 	type Info: record {
 		ts:       time;
 		message:  string;
@@ -106,5 +107,5 @@ event bro_init() &priority=5
 		terminate();
 		}
 	
-	Log::create_stream(CLUSTER, [$columns=Info]);
+	Log::create_stream(Cluster::LOG, [$columns=Info]);
 	}

scripts/base/frameworks/cluster/nodes/worker.bro

@@ -22,10 +22,5 @@ redef record_all_packets = T;
 # do remote logging since we forward the notice event directly.
 event bro_init()
 	{
-	Log::add_filter(Notice::NOTICE,
+	Log::disable_stream(Notice::LOG);
-		[
-		 $name="cluster-worker",
-		 $pred=function(rec: Notice::Info): bool { return F; }
-		]
-	);
 	}

scripts/base/frameworks/communication/main.bro

@@ -6,7 +6,7 @@
 module Communication;
 
 export {
-	redef enum Log::ID += { COMMUNICATION };
+	redef enum Log::ID += { LOG };
 	
 	const default_port_ssl = 47756/tcp &redef;
 	const default_port_clear = 47757/tcp &redef;
@@ -107,21 +107,18 @@ const src_names = {
 	[REMOTE_SRC_SCRIPT] = "script",
 };
 
-event bro_init()
+event bro_init() &priority=5
 	{
-	Log::create_stream(COMMUNICATION, [$columns=Info]);
+	Log::create_stream(Communication::LOG, [$columns=Info]);
-
-	if ( |nodes| > 0 )
-		enable_communication();
 	}
 
 function do_script_log_common(level: count, src: count, msg: string)
 	{
-	Log::write(COMMUNICATION, [$ts = network_time(), 
+	Log::write(Communication::LOG, [$ts = network_time(), 
-	                           $level = (level == REMOTE_LOG_INFO ? "info" : "error"),
+	                                $level = (level == REMOTE_LOG_INFO ? "info" : "error"),
-	                           $src_name = src_names[src],
+	                                $src_name = src_names[src],
-	                           $peer = get_event_peer()$descr,
+	                                $peer = get_event_peer()$descr,
-	                           $message = msg]);
+	                                $message = msg]);
 	}
 
 # This is a core generated event.
@@ -147,9 +144,9 @@ function connect_peer(peer: string)
 	local id = connect(node$host, p, class, node$retry, node$ssl);
     
 	if ( id == PEER_ID_NONE )
-		Log::write(COMMUNICATION, [$ts = network_time(), 
+		Log::write(Communication::LOG, [$ts = network_time(), 
-		                           $peer = get_event_peer()$descr,
+		                                $peer = get_event_peer()$descr,
-		                           $message = "can't trigger connect"]);
+		                                $message = "can't trigger connect"]);
 	pending_peers[id] = node;
 	}
 
@@ -275,15 +272,18 @@ event remote_state_inconsistency(operation: string, id: string,
 
 	local msg = fmt("state inconsistency: %s should be %s but is %s before %s",
 	                id, expected_old, real_old, operation);
-	Log::write(COMMUNICATION, [$ts = network_time(),
+	Log::write(Communication::LOG, [$ts = network_time(),
-	                           $peer = get_event_peer()$descr,
+	                                $peer = get_event_peer()$descr,
-	                           $message = msg]);
+	                                $message = msg]);
 	}
 
 
 # Actually initiate the connections that need to be established.
 event bro_init() &priority = -10 # let others modify nodes
 	{
+	if ( |nodes| > 0 )
+		enable_communication();
+	
 	for ( tag in nodes )
 		{
 		if ( ! nodes[tag]$connect )

scripts/base/frameworks/dpd/main.bro

@@ -7,7 +7,7 @@ module DPD;
 redef signature_files += "base/frameworks/dpd/dpd.sig";
 
 export {
-	redef enum Log::ID += { DPD };
+	redef enum Log::ID += { LOG };
 
 	type Info: record {
 		## Timestamp for when protocol analysis failed.
@@ -38,9 +38,9 @@ redef record connection += {
 	dpd: Info &optional;
 };
 
-event bro_init()
+event bro_init() &priority=5
 	{
-	Log::create_stream(DPD, [$columns=Info]);
+	Log::create_stream(DPD::LOG, [$columns=Info]);
 	
 	# Populate the internal DPD analysis variable.
 	for ( a in dpd_config )
@@ -104,5 +104,5 @@ event protocol_violation(c: connection, atype: count, aid: count,
 				reason: string) &priority=-5
 	{
 	if ( c?$dpd )
-		Log::write(DPD, c$dpd);
+		Log::write(DPD::LOG, c$dpd);
 	}

scripts/base/frameworks/intel/main.bro

@@ -25,7 +25,7 @@
 module Intel;
 
 export {
-	redef enum Log::ID += { INTEL };
+	redef enum Log::ID += { LOG };
 	
 	redef enum Notice::Type += {
 		## This notice should be used in all detector scripts to indicate 
@@ -101,7 +101,7 @@ export {
 
 event bro_init()
 	{
-	Log::create_stream(INTEL, [$columns=Info]);
+	Log::create_stream(Intel::LOG, [$columns=Info]);
 	}
 
 
@@ -163,7 +163,7 @@ function insert(item: Item): bool
 		}
 	
 	if ( err_msg != "" )
-		Log::write(INTEL, [$ts=network_time(), $level="warn", $message=fmt(err_msg)]);
+		Log::write(Intel::LOG, [$ts=network_time(), $level="warn", $message=fmt(err_msg)]);
 	return F;
 	}
 	
@@ -272,6 +272,6 @@ function matcher(item: QueryItem): bool
 		}
 		
 	if ( err_msg != "" )
-		Log::write(INTEL, [$ts=network_time(), $level="error", $message=fmt(err_msg)]);
+		Log::write(Intel::LOG, [$ts=network_time(), $level="error", $message=fmt(err_msg)]);
 	return F;
 	}

scripts/base/frameworks/logging/main.bro

@@ -172,8 +172,47 @@ function __default_rotation_postprocessor(info: RotationInfo) : bool
 
 function default_path_func(id: ID, path: string, rec: any) : string
 	{
-	# TODO for Seth: Do what you want. :)
+	local id_str = fmt("%s", id);
-	return path;
+	
+	local parts = split1(id_str, /::/);
+	if ( |parts| == 2 )
+		{
+		# TODO: the core shouldn't be suggesting paths anymore.  Only 
+		#       statically defined paths should be sent into here.  This
+		#       is only to cope with the core generated paths.
+		if ( to_lower(parts[2]) != path )
+			return path;
+		
+		# Example: Notice::LOG -> "notice"
+		if ( parts[2] == "LOG" )
+			{
+			local module_parts = split_n(parts[1], /[^A-Z][A-Z][a-z]*/, T, 4);
+			local output = "";
+			if ( 1 in module_parts )
+				output = module_parts[1];
+			if ( 2 in module_parts && module_parts[2] != "" )
+				output = cat(output, sub_bytes(module_parts[2],1,1), "_", sub_bytes(module_parts[2], 2, |module_parts[2]|));
+			if ( 3 in module_parts && module_parts[3] != "" )
+				output = cat(output, "_", module_parts[3]);
+			if ( 4 in module_parts && module_parts[4] != "" )
+				output = cat(output, sub_bytes(module_parts[4],1,1), "_", sub_bytes(module_parts[4], 2, |module_parts[4]|));
+			# TODO: There seems to be some problem with the split function 
+			#       not putting \0 at the end of the string.  fmt will make
+			#       a better internal string.
+			return fmt("%s", to_lower(output));
+			}
+		
+		# Example: Notice::POLICY_LOG -> "notice_policy"
+		if ( /_LOG$/ in parts[2] )
+			parts[2] = sub(parts[2], /_LOG$/, "");
+		
+		return cat(to_lower(parts[1]),"_",to_lower(parts[2]));
+		}
+	else
+		{
+		# In case there is a logging stream in the global namespace.
+		return to_lower(id_str);
+		}
 	}
 
 # Run post-processor on file. If there isn't any postprocessor defined,
@@ -217,7 +256,7 @@ function add_filter(id: ID, filter: Filter) : bool
 	# definition.
 	if ( ! filter?$path_func )
 		filter$path_func = default_path_func;
-
+	
 	filters[id, filter$name] = filter;
 	return __add_filter(id, filter);
 	}

scripts/base/frameworks/metrics/main.bro

@@ -5,7 +5,7 @@
 module Metrics;
 
 export {
-	redef enum Log::ID += { METRICS };
+	redef enum Log::ID += { LOG };
 	
 	type ID: enum {
 		NOTHING,
@@ -124,7 +124,7 @@ global thresholds: table[ID, string, Index] of count = {} &create_expire=renotic
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(METRICS, [$columns=Info, $ev=log_metrics]);
+	Log::create_stream(Metrics::LOG, [$columns=Info, $ev=log_metrics]);
 	}
 
 function index2str(index: Index): string
@@ -151,7 +151,7 @@ function write_log(ts: time, filter: Filter, data: MetricTable)
 		                 $value=val];
 		
 		if ( filter$log )
-			Log::write(METRICS, m);
+			Log::write(Metrics::LOG, m);
 		}
 	}
 

scripts/base/frameworks/notice/main.bro

@@ -9,15 +9,13 @@ module Notice;
 
 export {
 	redef enum Log::ID += { 
-		## This is the primary logging stream for notices.  It must always be
+		## This is the primary logging stream for notices.
-		## referenced with the module name included because the name is 
+		LOG, 
-		## also used by the global function :bro:id:`NOTICE`.
-		NOTICE, 
 		## This is the notice policy auditing log.  It records what the current
 		## notice policy is at Bro init time.
-		NOTICE_POLICY,
+		POLICY_LOG,
 		## This is the alarm stream.
-		ALARM,
+		ALARM_LOG,
 	};
 
 	## Scripts creating new notices need to redef this enum to add their own 
@@ -229,18 +227,19 @@ export {
 	};
 }
 
-event bro_init()
+event bro_init() &priority=5
 	{
-	Log::create_stream(NOTICE_POLICY, [$columns=PolicyItem]);
+	Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice]);
-	Log::create_stream(Notice::NOTICE, [$columns=Info, $ev=log_notice]);
+	Log::create_stream(Notice::POLICY_LOG, [$columns=PolicyItem]);
 	
-	Log::create_stream(ALARM, [$columns=Notice::Info]);
+	Log::create_stream(Notice::ALARM_LOG, [$columns=Notice::Info]);
 	# If Bro is configured for mailing notices, set up mailing for alarms.
 	# Make sure that this alarm log is also output as text so that it can
 	# be packaged up and emailed later.
 	if ( ! reading_traces() && mail_dest != "" )
-		Log::add_filter(ALARM, [$name="alarm-mail", $path="alarm-mail",
+		Log::add_filter(Notice::ALARM_LOG, [$name="alarm-mail", 
-		                        $writer=Log::WRITER_ASCII]);
+		                                    $path="alarm-mail",
+		                                    $writer=Log::WRITER_ASCII]);
 	}
 
 # TODO: fix this.
@@ -302,9 +301,9 @@ event notice(n: Notice::Info) &priority=-5
 	if ( ACTION_EMAIL in n$actions )
 		email_notice_to(n, mail_dest, T);
 	if ( ACTION_LOG in n$actions )
-		Log::write(Notice::NOTICE, n);
+		Log::write(Notice::LOG, n);
 	if ( ACTION_ALARM in n$actions )
-		Log::write(ALARM, n);
+		Log::write(Notice::ALARM_LOG, n);
 	}
 
 # Executes a script with all of the notice fields put into the
@@ -410,7 +409,7 @@ event bro_init() &priority=10
 				{
 				pi$position = |ordered_policy|;
 				ordered_policy[|ordered_policy|] = pi;
-				Log::write(NOTICE_POLICY, pi);
+				Log::write(Notice::POLICY_LOG, pi);
 				}
 			}
 		}

scripts/base/frameworks/notice/weird.bro

@@ -5,7 +5,7 @@
 module Weird;
 
 export {
-	redef enum Log::ID += { WEIRD };
+	redef enum Log::ID += { LOG };
 	
 	redef enum Notice::Type += {
 		## Generic unusual but alarm-worthy activity.
@@ -259,9 +259,9 @@ global did_inconsistency_msg: set[conn_id];
 # Used to pass the optional connection into report_weird().
 global current_conn: connection;
 
-event bro_init()
+event bro_init() &priority=5
 	{
-	Log::create_stream(WEIRD, [$columns=Info, $ev=log_weird]);
+	Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird]);
 	}
 
 function report_weird(t: time, name: string, id: string, have_conn: bool,
@@ -311,7 +311,7 @@ function report_weird(t: time, name: string, id: string, have_conn: bool,
 		add weird_ignore[id][name];
 		}
 		
-	Log::write(WEIRD, info);
+	Log::write(Weird::LOG, info);
 	}
 
 function report_weird_conn(t: time, name: string, id: string, addl: string,

scripts/base/frameworks/packet-filter/main.bro

@@ -9,7 +9,7 @@
 module PacketFilter;
 
 export {
-	redef enum Log::ID += { PACKET_FILTER };
+	redef enum Log::ID += { LOG };
 	
 	redef enum Notice::Type += {
 		## This notice is generated if a packet filter is unable to be compiled.
@@ -144,11 +144,11 @@ function install()
 		        $sub=default_filter]);
 		}
 	
-	Log::write(PACKET_FILTER, info);
+	Log::write(PacketFilter::LOG, info);
 	}
 
 event bro_init() &priority=10
 	{
-	Log::create_stream(PACKET_FILTER, [$columns=Info]);
+	Log::create_stream(PacketFilter::LOG, [$columns=Info]);
 	PacketFilter::install();
 	}

scripts/base/frameworks/reporter/main.bro

@@ -5,9 +5,13 @@
 module Reporter;
 
 export {
-	redef enum Log::ID += { REPORTER };
+	redef enum Log::ID += { LOG };
 	
-	type Level: enum { INFO, WARNING, ERROR };
+	type Level: enum { 
+		INFO, 
+		WARNING, 
+		ERROR
+	};
 	
 	type Info: record {
 		ts:       time   &log;
@@ -19,22 +23,22 @@ export {
 	};
 }
 
-event bro_init()
+event bro_init() &priority=5
 	{
-	Log::create_stream(REPORTER, [$columns=Info]);
+	Log::create_stream(Reporter::LOG, [$columns=Info]);
 	}
 
 event reporter_info(t: time, msg: string, location: string)
 	{
-	Log::write(REPORTER, [$ts=t, $level=INFO, $message=msg, $location=location]);
+	Log::write(Reporter::LOG, [$ts=t, $level=INFO, $message=msg, $location=location]);
 	}
 	
 event reporter_warning(t: time, msg: string, location: string)
 	{
-	Log::write(REPORTER, [$ts=t, $level=WARNING, $message=msg, $location=location]);
+	Log::write(Reporter::LOG, [$ts=t, $level=WARNING, $message=msg, $location=location]);
 	}
 
 event reporter_error(t: time, msg: string, location: string)
 	{
-	Log::write(REPORTER, [$ts=t, $level=ERROR, $message=msg, $location=location]);
+	Log::write(Reporter::LOG, [$ts=t, $level=ERROR, $message=msg, $location=location]);
 	}

scripts/base/frameworks/signatures/main.bro

@@ -25,7 +25,7 @@ export {
 		Signature_Summary,
 	};
 
-	redef enum Log::ID += { SIGNATURES };
+	redef enum Log::ID += { LOG };
 
 	## These are the default actions you can apply to signature matches.
 	## All of them write the signature record to the logging stream unless
@@ -114,7 +114,7 @@ global did_sig_log: set[string] &read_expire = 1 hr;
 
 event bro_init()
 	{
-	Log::create_stream(SIGNATURES, [$columns=Info, $ev=log_signature]);
+	Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature]);
 	}
 		
 # Returns true if the given signature has already been triggered for the given
@@ -174,7 +174,7 @@ event signature_match(state: signature_state, msg: string, data: string)
 		                    $event_msg=fmt("%s: %s", src_addr, msg),
 		                    $sig_id=sig_id,
 		                    $sub_msg=data];
-		Log::write(SIGNATURES, info);
+		Log::write(Signatures::LOG, info);
 		}
 
 	local notice = F;
@@ -248,7 +248,7 @@ event signature_match(state: signature_state, msg: string, data: string)
 			fmt("%s has triggered signature %s on %d hosts",
 				orig, sig_id, hcount);
 
-		Log::write(SIGNATURES, 
+		Log::write(Signatures::LOG, 
 			[$note=Multiple_Sig_Responders,
 		     $src_addr=orig, $sig_id=sig_id, $event_msg=msg,
 		     $host_count=hcount, $sub_msg=horz_scan_msg]);
@@ -265,7 +265,7 @@ event signature_match(state: signature_state, msg: string, data: string)
 			fmt("%s has triggered %d different signatures on host %s",
 				orig, vcount, resp);
 
-		Log::write(SIGNATURES, 
+		Log::write(Signatures::LOG, 
 			[$ts=network_time(),
 			 $note=Multiple_Signatures, 
 			 $src_addr=orig,

scripts/base/frameworks/software/main.bro

@@ -11,7 +11,7 @@ module Software;
 
 export {
 
-	redef enum Log::ID += { SOFTWARE };
+	redef enum Log::ID += { LOG };
 
 	type Type: enum {
 		UNKNOWN,
@@ -103,7 +103,7 @@ export {
 
 event bro_init()
 	{
-	Log::create_stream(SOFTWARE, [$columns=Info, $ev=log_software]);
+	Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software]);
 	}
 
 function parse_mozilla(unparsed_version: string, 
@@ -379,7 +379,7 @@ event software_register(id: conn_id, info: Info)
 			return;
 		}
 	
-	Log::write(SOFTWARE, info);
+	Log::write(Software::LOG, info);
 	ts[info$name] = info;
 	}
 

scripts/base/protocols/conn/main.bro

@@ -3,7 +3,7 @@
 module Conn;
 
 export {
-	redef enum Log::ID += { CONN };
+	redef enum Log::ID += { LOG };
 
 	type Info: record {
 		## This is the time of the first packet.
@@ -95,7 +95,7 @@ redef record connection += {
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(CONN, [$columns=Info, $ev=log_conn]);
+	Log::create_stream(Conn::LOG, [$columns=Info, $ev=log_conn]);
 	}
 
 function conn_state(c: connection, trans: transport_proto): string
@@ -216,6 +216,6 @@ event connection_state_remove(c: connection) &priority=5
 
 event connection_state_remove(c: connection) &priority=-5
 	{
-	Log::write(CONN, c$conn);
+	Log::write(Conn::LOG, c$conn);
 	}
 

scripts/base/protocols/dns/main.bro

@@ -3,7 +3,7 @@
 module DNS;
 
 export {
-	redef enum Log::ID += { DNS };
+	redef enum Log::ID += { LOG };
 	
 	type Info: record {
 		ts:            time            &log;
@@ -77,7 +77,7 @@ redef dpd_config += { [ANALYZER_DNS_TCP_BINPAC] = [$ports = dns_tcp_ports] };
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(DNS, [$columns=Info, $ev=log_dns]);
+	Log::create_stream(DNS::LOG, [$columns=Info, $ev=log_dns]);
 	}
 
 function new_session(c: connection, trans_id: count): Info
@@ -163,7 +163,7 @@ event do_reply(c: connection, msg: dns_msg, ans: dns_answer, reply: string) &pri
 	{
 	if ( c$dns$ready )
 		{
-		Log::write(DNS, c$dns);
+		Log::write(DNS::LOG, c$dns);
 		add c$dns_state$finished_answers[c$dns$trans_id];
 		# This record is logged and no longer pending.
 		delete c$dns_state$pending[c$dns$trans_id];
@@ -275,6 +275,6 @@ event connection_state_remove(c: connection) &priority=-5
 	# If Bro is expiring state, we should go ahead and log all unlogged 
 	# request/response pairs now.
 	for ( trans_id in c$dns_state$pending )
-		Log::write(DNS, c$dns_state$pending[trans_id]);
+		Log::write(DNS::LOG, c$dns_state$pending[trans_id]);
 	}
 	

scripts/base/protocols/ftp/main.bro

@@ -14,7 +14,7 @@
 module FTP;
 
 export {
-	redef enum Log::ID += { FTP };
+	redef enum Log::ID += { LOG };
 
 	## This setting changes if passwords used in FTP sessions are captured or not.
 	const default_capture_password = F &redef;
@@ -95,7 +95,7 @@ global ftp_data_expected: table[addr, port] of ExpectedConn &create_expire=5mins
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(FTP, [$columns=Info, $ev=log_ftp]);
+	Log::create_stream(FTP::LOG, [$columns=Info, $ev=log_ftp]);
 	}
 
 ## A set of commands where the argument can be expected to refer
@@ -165,7 +165,7 @@ function ftp_message(s: Info)
 		else
 			s$arg=arg;
 		
-		Log::write(FTP, s);
+		Log::write(FTP::LOG, s);
 		}
 	
 	# The MIME and file_size fields are specific to file transfer commands 

scripts/base/protocols/http/main.bro

@@ -4,7 +4,7 @@
 module HTTP;
 
 export {
-	redef enum Log::ID += { HTTP };
+	redef enum Log::ID += { LOG };
 
 	## Indicate a type of attack or compromise in the record to be logged.
 	type Tags: enum {
@@ -86,7 +86,7 @@ redef record connection += {
 # Initialize the HTTP logging stream.
 event bro_init() &priority=5
 	{
-	Log::create_stream(HTTP, [$columns=Info, $ev=log_http]);
+	Log::create_stream(HTTP::LOG, [$columns=Info, $ev=log_http]);
 	}
 
 # DPD configuration.
@@ -230,7 +230,7 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &
 	# The reply body is done so we're ready to log.
 	if ( ! is_orig )
 		{
-		Log::write(HTTP, c$http);
+		Log::write(HTTP::LOG, c$http);
 		delete c$http_state$pending[c$http_state$current_response];
 		}
 	}
@@ -242,7 +242,7 @@ event connection_state_remove(c: connection)
 		{
 		for ( r in c$http_state$pending )
 			{
-			Log::write(HTTP, c$http_state$pending[r]);
+			Log::write(HTTP::LOG, c$http_state$pending[r]);
 			}
 		}
 	}

scripts/base/protocols/irc/dcc-send.bro

@@ -73,7 +73,7 @@ event file_transferred(c: connection, prefix: string, descr: string,
 
 	local tmp = irc$command;
 	irc$command = "DCC";
-	Log::write(IRC, irc);
+	Log::write(IRC::LOG, irc);
 	irc$command = tmp;
 
 	if ( irc$extract_file && irc?$extraction_file )

scripts/base/protocols/irc/main.bro

@@ -7,7 +7,7 @@
 module IRC;
 
 export {
-	redef enum Log::ID += { IRC };
+	redef enum Log::ID += { LOG };
 
 	type Tag: enum { 
 		EMPTY 
@@ -44,7 +44,7 @@ redef dpd_config += { [ANALYZER_IRC] = [$ports = irc_ports] };
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(IRC, [$columns=Info, $ev=irc_log]);
+	Log::create_stream(IRC::LOG, [$columns=Info, $ev=irc_log]);
 	}
 	
 function new_session(c: connection): Info
@@ -78,7 +78,7 @@ event irc_nick_message(c: connection, is_orig: bool, who: string, newnick: strin
 	{
 	if ( is_orig )
 		{
-		Log::write(IRC, c$irc);
+		Log::write(IRC::LOG, c$irc);
 		c$irc$nick  = newnick;
 		}
 	}
@@ -98,7 +98,7 @@ event irc_user_message(c: connection, is_orig: bool, user: string, host: string,
 	{
 	if ( is_orig )
 		{
-		Log::write(IRC, c$irc);
+		Log::write(IRC::LOG, c$irc);
 		c$irc$user = user;
 		}
 	}
@@ -118,7 +118,7 @@ event irc_join_message(c: connection, is_orig: bool, info_list: irc_join_list) &
 			{
 			c$irc$value = l$channel;
 			c$irc$addl = (l$password != "" ? fmt(" with channel key: '%s'", l$password) : "");
-			Log::write(IRC, c$irc);
+			Log::write(IRC::LOG, c$irc);
 			}
 		}
 	}

scripts/base/protocols/mime/__load__.bro

@@ -1,4 +0,0 @@
-@load ./main
-@load ./file-ident
-@load ./file-extract
-@load ./file-hash

scripts/base/protocols/mime/file-extract.bro

@@ -1,62 +0,0 @@
-@load ./file-ident
-@load base/utils/files
-
-module MIME;
-
-export {
-	## Pattern of file mime types to extract from MIME bodies.
-	const extract_file_types = /NO_DEFAULT/ &redef;
-
-	## The on-disk prefix for files to be extracted from MIME entity bodies.
-	const extraction_prefix = "mime-item" &redef;
-
-	redef record Info += {
-		## Optionally write the file to disk.  Must be set prior to first 
-		## data chunk being seen in an event.
-		extract_file:         bool    &default=F;
-	
-		## Store the file handle here for the file currently being extracted.
-		extraction_file:      file    &log &optional;
-	};
-
-	redef record State += {
-		## Store a count of the number of files that have been transferred in
-		## this conversation to create unique file names on disk.
-		num_extracted_files:  count   &default=0;
-	};
-}
-
-event mime_segment_data(c: connection, length: count, data: string) &priority=5
-	{
-	if ( extract_file_types in c$mime$mime_type ) 
-		c$mime$extract_file = T;
-	}
-
-event mime_segment_data(c: connection, length: count, data: string) &priority=3
-	{
-	if ( c$mime$extract_file && c$mime$content_len == 0 )
-		{
-		local suffix = fmt("%d.dat", ++c$mime_state$num_extracted_files);
-		local fname = generate_extraction_filename(extraction_prefix, c, suffix);
-		c$mime$extraction_file = open(fname);
-		enable_raw_output(c$mime$extraction_file);
-		}
-	}
-	
-event mime_segment_data(c: connection, length: count, data: string) &priority=-5
-	{
-	if ( c$mime$extract_file && c$mime?$extraction_file )
-		print c$mime$extraction_file, data;
-	}
-	
-event mime_end_entity(c: connection) &priority=-3
-	{
-	# TODO: this check is only due to a bug in mime_end_entity that
-	#       causes the event to be generated twice for the same real event.
-	if ( ! c?$mime )
-		return;
-		
-	if ( c$mime?$extraction_file )
-		close(c$mime$extraction_file);
-	}
-	

scripts/base/protocols/mime/file-hash.bro

@@ -1,79 +0,0 @@
-@load ./file-ident
-@load base/frameworks/notice
-
-module MIME;
-
-export {
-	redef enum Notice::Type += {
-		## Indicates that an MD5 sum was calculated for a MIME message.
-		MD5,
-	};
-	
-	redef record Info += {	
-		## The calculated MD5 sum for the MIME entity.
-		md5:             string  &log &optional;
-		
-		## Optionally calculate the file's MD5 sum.  Must be set prior to the 
-		## first data chunk being see in an event.
-		calc_md5:        bool    &default=F;
-		
-		## This boolean value indicates if an MD5 sum is being calculated 
-		## for the current file transfer.
-		calculating_md5: bool    &default=F;
-	};
-	
-	## Generate MD5 sums for these filetypes.
-	const generate_md5 = /application\/x-dosexec/    # Windows and DOS executables
-	                   | /application\/x-executable/ # *NIX executable binary
-	                   &redef;
-}
-
-event mime_segment_data(c: connection, length: count, data: string) &priority=-5
-	{
-	if ( ! c?$mime ) return;
-	
-	if ( c$mime$content_len == 0 )
-		{
-		if ( generate_md5 in c$mime$mime_type )
-			c$mime$calc_md5 = T;
-		
-		if ( c$mime$calc_md5 )
-			{
-			c$mime$calculating_md5 = T;
-			md5_hash_init(c$id);
-			}
-		}
-	
-	if ( c$mime$calculating_md5 )
-		md5_hash_update(c$id, data);
-	}
-	
-## In the event of a content gap during the MIME transfer, detect the state for
-## the MD5 sum calculation and stop calculating the MD5 since it would be 
-## incorrect anyway.
-event content_gap(c: connection, is_orig: bool, seq: count, length: count) &priority=5
-	{
-	if ( is_orig || ! c?$mime ) return;
-
-	if ( c$mime$calculating_md5 )
-		{
-		c$mime$calculating_md5 = F;
-		md5_hash_finish(c$id);
-		}
-	}
-	
-event mime_end_entity(c: connection) &priority=-3
-	{
-	# TODO: this check is only due to a bug in mime_end_entity that
-	#       causes the event to be generated twice for the same real event.
-	if ( ! c?$mime )
-		return;
-	
-	if ( c$mime$calculating_md5 )
-		{
-		c$mime$md5 = md5_hash_finish(c$id);
-		
-		NOTICE([$note=MD5, $msg=fmt("Calculated a hash for a MIME entity from %s", c$id$orig_h),
-		        $sub=c$mime$md5, $conn=c]);
-		}
-	}

scripts/base/protocols/mime/file-ident.bro

@@ -1,16 +0,0 @@
-@load ./main
-
-module MIME;
-
-export {
-	redef record Info += {
-		## Sniffed MIME type for the transfer.
-		mime_type:        string  &log &optional;
-	};
-}
-
-event mime_segment_data(c: connection, length: count, data: string) &priority=7
-	{
-	if ( c$mime$content_len == 0 )
-		c$mime$mime_type = split1(identify_data(data, T), /;/)[1];
-	}

scripts/base/protocols/mime/main.bro

@@ -1,101 +0,0 @@
-##! The mime script does analysis of MIME encoded messages seen in certain
-##! protocols (only SMTP and POP3 at the moment).
-
-@load base/utils/strings
-
-module MIME;
-
-export {
-	redef enum Log::ID += { MIME };
-
-	# Let's assume for now that nothing transferring files using 
-	# MIME attachments is multiplexing for simplicity's sake.
-	#   We can make the assumption that one connection == one file (at a time)
-	
-	type Info: record {
-		## This is the timestamp of when the MIME content transfer began.
-		ts:               time    &log;
-		uid:              string  &log;
-		id:               conn_id &log;
-		## The application layer protocol over which the transfer was seen.
-		app_protocol:     string  &log &optional;
-		## The filename seen in the Content-Disposition header.
-		filename:         string  &log &optional;
-		## Track how many byte of the MIME encoded file have been seen.
-		content_len:      count   &log &default=0;
-	};
-	
-	type State: record {
-		## Track the number of MIME encoded files transferred during this session.
-		level:            count   &default=0;
-	};
-	
-	global log_mime: event(rec: Info);
-}
-
-redef record connection += {
-	mime:       Info &optional;
-	mime_state: State &optional;
-};
-
-event bro_init()
-	{
-	Log::create_stream(MIME, [$columns=Info, $ev=log_mime]);
-	}
-
-function new_mime_session(c: connection): Info
-	{
-	local info: Info;
-	
-	info$ts=network_time();
-	info$uid=c$uid;
-	info$id=c$id;
-	return info;
-	}
-
-function set_session(c: connection, new_entity: bool)
-	{
-	if ( ! c?$mime_state )
-		c$mime_state = [];
-	
-	if ( ! c?$mime || new_entity )
-		c$mime = new_mime_session(c);
-	}
-
-event mime_begin_entity(c: connection) &priority=10
-	{
-	set_session(c, T);
-
-	++c$mime_state$level;
-	
-	if ( |c$service| > 0 )
-		c$mime$app_protocol = join_string_set(c$service, ",");
-	}
-
-# This has priority -10 because other handlers need to know the current 
-# content_len before it's updated by this handler.
-event mime_segment_data(c: connection, length: count, data: string) &priority=-10
-	{
-	c$mime$content_len = c$mime$content_len + length;
-	}
-	
-event mime_one_header(c: connection, h: mime_header_rec)
-	{
-	if ( h$name == "CONTENT-DISPOSITION" &&
-	          /[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value )
-		c$mime$filename = sub(h$value, /^.*[fF][iI][lL][eE][nN][aA][mM][eE]=/, "");
-	}
-	
-event mime_end_entity(c: connection) &priority=-5
-	{
-	# This check and the delete below are just to cope with a bug where 
-	# mime_end_entity can be generated multiple times for the same event.
-	if ( ! c?$mime )
-		return;
-	
-	# Don't log anything if there wasn't any content.
-	if ( c$mime$content_len > 0 )
-		Log::write(MIME, c$mime);
-	
-	delete c$mime;
-	}

scripts/base/protocols/smtp/entities.bro

@@ -12,7 +12,7 @@ export {
 		MD5,
 	};
 
-	redef enum Log::ID += { SMTP_ENTITIES };
+	redef enum Log::ID += { ENTITIES_LOG };
 
 	type EntityInfo: record {
 		## This is the timestamp of when the MIME content transfer began.
@@ -74,7 +74,7 @@ export {
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(SMTP_ENTITIES, [$columns=EntityInfo, $ev=log_mime]);
+	Log::create_stream(SMTP::ENTITIES_LOG, [$columns=EntityInfo, $ev=log_mime]);
 	}
 
 function set_session(c: connection, new_entity: bool)
@@ -185,7 +185,7 @@ event mime_end_entity(c: connection) &priority=-5
 
 	# Only log is there was some content.
 	if ( c$smtp$current_entity$content_len > 0 )
-		Log::write(SMTP_ENTITIES, c$smtp$current_entity);
+		Log::write(SMTP::ENTITIES_LOG, c$smtp$current_entity);
 
 	delete c$smtp$current_entity;
 	}

scripts/base/protocols/smtp/main.bro

@@ -5,7 +5,7 @@
 module SMTP;
 
 export {
-	redef enum Log::ID += { SMTP };
+	redef enum Log::ID += { LOG };
 
 	type Info: record {
 		ts:                time            &log;
@@ -73,7 +73,7 @@ redef dpd_config += { [ANALYZER_SMTP] = [$ports = ports] };
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(SMTP, [$columns=SMTP::Info, $ev=log_smtp]);
+	Log::create_stream(SMTP::LOG, [$columns=SMTP::Info, $ev=log_smtp]);
 	}
 	
 function find_address_in_smtp_header(header: string): string
@@ -119,7 +119,7 @@ function set_smtp_session(c: connection)
 function smtp_message(c: connection)
 	{
 	if ( c$smtp$has_client_activity )
-		Log::write(SMTP, c$smtp);
+		Log::write(SMTP::LOG, c$smtp);
 	}
 	
 event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &priority=5

scripts/base/protocols/ssh/main.bro

@@ -14,7 +14,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 	
 	redef enum Notice::Type += { 
 		## This indicates that a heuristically detected "successful" SSH 
@@ -79,7 +79,7 @@ redef record connection += {
 
 event bro_init() &priority=5
 {
-	Log::create_stream(SSH, [$columns=Info, $ev=log_ssh]);
+	Log::create_stream(SSH::LOG, [$columns=Info, $ev=log_ssh]);
 }
 
 function set_session(c: connection)
@@ -149,11 +149,11 @@ event SSH::heuristic_successful_login(c: connection) &priority=-5
 	        $msg="Heuristically detected successful SSH login.",
 	        $conn=c]);
 	
-	Log::write(SSH, c$ssh);
+	Log::write(SSH::LOG, c$ssh);
 	}
 event SSH::heuristic_failed_login(c: connection) &priority=-5
 	{
-	Log::write(SSH, c$ssh);
+	Log::write(SSH::LOG, c$ssh);
 	}
 
 event connection_state_remove(c: connection) &priority=-5

scripts/base/protocols/ssl/main.bro

@@ -4,7 +4,7 @@
 module SSL;
 
 export {
-	redef enum Log::ID += { SSL };
+	redef enum Log::ID += { LOG };
 
 	redef enum Notice::Type += {
 		Self_Signed_Cert
@@ -43,7 +43,7 @@ redef record connection += {
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(SSL, [$columns=Info, $ev=log_ssl]);
+	Log::create_stream(SSL::LOG, [$columns=Info, $ev=log_ssl]);
 	}
 
 redef capture_filters += {
@@ -117,6 +117,6 @@ event ssl_established(c: connection) &priority=-5
 	{
 	set_session(c);
 	
-	Log::write(SSL, c$ssl);
+	Log::write(SSL::LOG, c$ssl);
 	}
 	

scripts/base/protocols/syslog/main.bro

@@ -5,7 +5,7 @@
 module Syslog;
 
 export {
-	redef enum Log::ID += { SYSLOG };
+	redef enum Log::ID += { LOG };
 	
 	type Info: record {
 		ts:        time            &log;
@@ -29,7 +29,7 @@ redef record connection += {
 
 event bro_init() &priority=5
 	{
-	Log::create_stream(SYSLOG, [$columns=Info]);
+	Log::create_stream(Syslog::LOG, [$columns=Info]);
 	}
 
 event syslog_message(c: connection, facility: count, severity: count, msg: string) &priority=5
@@ -48,5 +48,5 @@ event syslog_message(c: connection, facility: count, severity: count, msg: strin
 
 event syslog_message(c: connection, facility: count, severity: count, msg: string) &priority=-5
 	{
-	Log::write(SYSLOG, c$syslog);
+	Log::write(Syslog::LOG, c$syslog);
 	}

scripts/policy/integration/barnyard2/main.bro

@@ -7,7 +7,7 @@
 module Barnyard2;
 
 export {
-	redef enum Log::ID += { BARNYARD2 };
+	redef enum Log::ID += { LOG };
 	
 	type Info: record {
 		ts:                 time      &log;
@@ -21,9 +21,9 @@ export {
 	global pid2cid: function(p: PacketID): conn_id;
 }
 
-event bro_init()
+event bro_init() &priority=5
 	{
-	Log::create_stream(BARNYARD2, [$columns=Info]);
+	Log::create_stream(Barnyard2::LOG, [$columns=Info]);
 	}
 
 
@@ -34,7 +34,7 @@ function pid2cid(p: PacketID): conn_id
 
 event barnyard_alert(id: PacketID, alert: AlertData, msg: string, data: string)
 	{
-	Log::write(BARNYARD2, [$ts=network_time(), $pid=id, $alert=alert]);
+	Log::write(Barnyard2::LOG, [$ts=network_time(), $pid=id, $alert=alert]);
 	
 	#local proto_connection_string: string;
 	#if ( id$src_p == 0/tcp )

scripts/policy/misc/loaded-scripts.bro

@@ -1,7 +1,7 @@
 module LoadedScripts;
 
 export {
-	redef enum Log::ID += { LOADED_SCRIPTS };
+	redef enum Log::ID += { LOG };
 	
 	type Info: record {
 		depth:  count  &log;
@@ -11,10 +11,10 @@ export {
 
 event bro_init()
 	{
-	Log::create_stream(LOADED_SCRIPTS, [$columns=Info]);
+	Log::create_stream(LoadedScripts::LOG, [$columns=Info]);
 	}
 
 event bro_script_loaded(path: string, level: count)
 	{
-	Log::write(LOADED_SCRIPTS, [$depth=level, $name=path]);
+	Log::write(LoadedScripts::LOG, [$depth=level, $name=path]);
 	}

scripts/policy/protocols/conn/known-hosts.bro

@@ -5,10 +5,10 @@
 
 @load base/utils/directions-and-hosts
 
-module KnownHosts;
+module Known;
 
 export {
-	redef enum Log::ID += { KNOWN_HOSTS };
+	redef enum Log::ID += { HOSTS_LOG };
 	
 	type Info: record {
 		## The timestamp at which the host was detected.
@@ -20,7 +20,7 @@ export {
 	
 	## The hosts whose existence should be logged and tracked.
 	## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
-	const asset_tracking = LOCAL_HOSTS &redef;
+	const host_tracking = LOCAL_HOSTS &redef;
 	
 	## The set of all known addresses to store for preventing duplicate 
 	## logging of addresses.  It can also be used from other scripts to 
@@ -34,7 +34,7 @@ export {
 
 event bro_init()
 	{
-	Log::create_stream(KNOWN_HOSTS, [$columns=Info, $ev=log_known_hosts]);
+	Log::create_stream(Known::HOSTS_LOG, [$columns=Info, $ev=log_known_hosts]);
 	}
 
 event connection_established(c: connection) &priority=5
@@ -43,10 +43,10 @@ event connection_established(c: connection) &priority=5
 	
 	for ( host in set(id$orig_h, id$resp_h) )
 		{
-		if ( host !in known_hosts && addr_matches_host(host, asset_tracking) )
+		if ( host !in known_hosts && addr_matches_host(host, host_tracking) )
 			{
 			add known_hosts[host];
-			Log::write(KNOWN_HOSTS, [$ts=network_time(), $host=host]);
+			Log::write(Known::HOSTS_LOG, [$ts=network_time(), $host=host]);
 			}
 		}
 	}

scripts/policy/protocols/conn/known-services.bro

@@ -5,9 +5,9 @@
 
 @load base/utils/directions-and-hosts
 
-module KnownServices;
+module Known;
 
-redef enum Log::ID += { KNOWN_SERVICES };
+redef enum Log::ID += { SERVICES_LOG };
 
 export {
 	type Info: record {
@@ -21,7 +21,7 @@ export {
 	};
 	
 	## The hosts whose services should be tracked and logged.
-	const asset_tracking = LOCAL_HOSTS &redef;
+	const service_tracking = LOCAL_HOSTS &redef;
 	
 	global known_services: set[addr, port] &create_expire=1day &synchronized;
 	
@@ -35,8 +35,8 @@ redef record connection += {
 
 event bro_init()
 	{
-	Log::create_stream(KNOWN_SERVICES, [$columns=Info,
+	Log::create_stream(Known::SERVICES_LOG, [$columns=Info,
-	                                    $ev=log_known_services]);
+	                                        $ev=log_known_services]);
 	}
 	
 function known_services_done(c: connection)
@@ -44,7 +44,7 @@ function known_services_done(c: connection)
 	local id = c$id;
 	if ( ! c$known_services_done &&
 	     get_port_transport_proto(id$resp_p) == tcp &&
-	     addr_matches_host(id$resp_h, asset_tracking) &&
+	     addr_matches_host(id$resp_h, service_tracking) &&
 	     [id$resp_h, id$resp_p] !in known_services &&
 	     "ftp-data" !in c$service ) # don't include ftp data sessions
 		{
@@ -56,7 +56,7 @@ function known_services_done(c: connection)
 		i$service=c$service;
 		
 		add known_services[id$resp_h, id$resp_p];
-		Log::write(KNOWN_SERVICES, i);
+		Log::write(Known::SERVICES_LOG, i);
 		c$known_services_done = T;
 		}
 	}

scripts/policy/protocols/ssl/known-certs.bro

@@ -1,9 +1,9 @@
 @load base/utils/directions-and-hosts
 
-module KnownCerts;
+module Known;
 
 export {
-	redef enum Log::ID += { KNOWN_CERTS };
+	redef enum Log::ID += { CERTS_LOG };
 	
 	type Info: record {
 		## The timestamp when the certificate was detected.
@@ -23,7 +23,7 @@ export {
 	
 	## The certificates whose existence should be logged and tracked.
 	## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
-	const asset_tracking = LOCAL_HOSTS &redef;
+	const cert_tracking = LOCAL_HOSTS &redef;
 	
 	## The set of all known certificates to store for preventing duplicate 
 	## logging.  It can also be used from other scripts to 
@@ -36,7 +36,7 @@ export {
 
 event bro_init()
 	{
-	Log::create_stream(KNOWN_CERTS, [$columns=Info, $ev=log_known_certs]);
+	Log::create_stream(Known::CERTS_LOG, [$columns=Info, $ev=log_known_certs]);
 	}
 
 event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string)
@@ -47,12 +47,12 @@ event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: co
 	if ( chain_idx != 0 ) return;
 		
 	local host = c$id$resp_h;
-	if ( [host, cert$serial] !in known_certs && addr_matches_host(host, asset_tracking) )
+	if ( [host, cert$serial] !in known_certs && addr_matches_host(host, cert_tracking) )
 		{
 		add known_certs[host, cert$serial];
-		Log::write(KNOWN_CERTS, [$ts=network_time(), $host=host,
+		Log::write(Known::CERTS_LOG, [$ts=network_time(), $host=host,
-		                         $port_num=c$id$resp_p, $subject=cert$subject,
+		                              $port_num=c$id$resp_p, $subject=cert$subject,
-		                         $issuer_subject=cert$issuer,
+		                              $issuer_subject=cert$issuer,
-		                         $serial=cert$serial]);
+		                              $serial=cert$serial]);
 		}
 	}

scripts/policy/tuning/track-all-assets.bro

@@ -3,7 +3,7 @@
 @load protocols/conn/known-services
 @load protocols/ssl/known-certs
 
-redef Software::asset_tracking      = ALL_HOSTS;
+redef Software::asset_tracking  = ALL_HOSTS;
-redef KnownHosts::asset_tracking    = ALL_HOSTS;
+redef Known::host_tracking      = ALL_HOSTS;
-redef KnownServices::asset_tracking = ALL_HOSTS;
+redef Known::service_tracking   = ALL_HOSTS;
-redef KnownCerts::asset_tracking    = ALL_HOSTS;
+redef Known::cert_tracking      = ALL_HOSTS;

testing/btest/Baseline/doc.autogen-reST-example/example.rst

@@ -263,7 +263,7 @@ Redefinitions
 
    :Type: :bro:type:`enum`
 
-      .. bro:enum:: Example::EXAMPLE Log::ID
+      .. bro:enum:: Example::LOG Log::ID
 
 :bro:type:`Example::SimpleEnum`
 

testing/btest/Baseline/scripts.base.frameworks.logging.remote-types/receiver.test.log

@@ -1,2 +1,2 @@
 # b	i	e	c	p	sn	a	d	t	iv	s	sc	ss	se	vc	ve
-T	-42	Test::TEST	21	123	10.0.0.0/24	1.2.3.4	3.14	1313623666.027768	100.0	hurz	2,4,1,3	CC,AA,BB	EMPTY	10,20,30	EMPTY
+T	-42	Test::LOG	21	123	10.0.0.0/24	1.2.3.4	3.14	1315018965.519383	100.0	hurz	2,4,1,3	CC,AA,BB	EMPTY	10,20,30	EMPTY

testing/btest/scripts/base/frameworks/logging/adapt-filter.bro

@@ -7,7 +7,7 @@ module SSH;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -21,13 +21,13 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Info]);
+	Log::create_stream(SSH::LOG, [$columns=Info]);
 
-	local filter = Log::get_filter(SSH, "default");
+	local filter = Log::get_filter(SSH::LOG, "default");
 	filter$path= "ssh-new-default";
-	Log::add_filter(SSH, filter);
+	Log::add_filter(SSH::LOG, filter);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
 }

testing/btest/scripts/base/frameworks/logging/ascii-binary.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Info: record {
 		data: string;
@@ -17,9 +17,9 @@ redef LogAscii::separator = "|";
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Info]);
+	Log::create_stream(SSH::LOG, [$columns=Info]);
-	Log::write(SSH, [$data="abc\n\xffdef", $data2="DATA2"]);
+	Log::write(SSH::LOG, [$data="abc\n\xffdef", $data2="DATA2"]);
-	Log::write(SSH, [$data="abc|\xffdef", $data2="DATA2"]);
+	Log::write(SSH::LOG, [$data="abc|\xffdef", $data2="DATA2"]);
-	Log::write(SSH, [$data="abc\xff|def", $data2="DATA2"]);
+	Log::write(SSH::LOG, [$data="abc\xff|def", $data2="DATA2"]);
 }
 

testing/btest/scripts/base/frameworks/logging/ascii-empty.bro

@@ -11,7 +11,7 @@ redef LogAscii::header_prefix = "PREFIX<>";
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -24,15 +24,15 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $b=T, $status="failure", $country=""]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $b=T, $status="failure", $country=""]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/ascii-escape.bro

@@ -7,7 +7,7 @@ redef LogAscii::separator = "||";
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -19,14 +19,14 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="fa||ure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="fa||ure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="su||ess", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="su||ess", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);	
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);	
 }
 

testing/btest/scripts/base/frameworks/logging/ascii-options.bro

@@ -9,7 +9,7 @@ redef LogAscii::include_header = F;
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -21,15 +21,15 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/ascii-timestamps.bro

@@ -5,7 +5,7 @@
 module Test;
 
 export {
-	redef enum Log::ID += { TEST };
+	redef enum Log::ID += { LOG };
 
 	type Info: record {
 		data: time &log;
@@ -14,14 +14,14 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(TEST, [$columns=Info]);
+	Log::create_stream(Test::LOG, [$columns=Info]);
-	Log::write(TEST, [$data=double_to_time(1234567890)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.0)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.0)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.01)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.01)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.001)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.001)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.0001)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.0001)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.00001)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.00001)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.000001)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.000001)]);
-	Log::write(TEST, [$data=double_to_time(1234567890.0000001)]);
+	Log::write(Test::LOG, [$data=double_to_time(1234567890.0000001)]);
 }
 

testing/btest/scripts/base/frameworks/logging/attr-extend.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -28,10 +28,10 @@ redef record Log += {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $a1=1, $a2=2, $b1=3, $b2=4]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $a1=1, $a2=2, $b1=3, $b2=4]);
 }
 

testing/btest/scripts/base/frameworks/logging/attr.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -17,15 +17,15 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/disable-stream.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -17,17 +17,17 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
-	Log::disable_stream(SSH);
+	Log::disable_stream(SSH::LOG);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/empty-event.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -19,15 +19,15 @@ global log_ssh: event(rec: Log);
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log, $ev=log_ssh]);
+	Log::create_stream(SSH::LOG, [$columns=Log, $ev=log_ssh]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/events.bro

@@ -6,7 +6,7 @@ module SSH;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -22,12 +22,12 @@ global ssh_log: event(rec: Log);
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log, $ev=ssh_log]);
+	Log::create_stream(SSH::LOG, [$columns=Log, $ev=ssh_log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 	local r: Log = [$t=network_time(), $id=cid, $status="success"];
-	Log::write(SSH, r);
+	Log::write(SSH::LOG, r);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/exclude.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -17,18 +17,18 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
-	Log::remove_default_filter(SSH);
+	Log::remove_default_filter(SSH::LOG);
-	Log::add_filter(SSH, [$name="f1", $exclude=set("t", "id.orig_h")]);
+	Log::add_filter(SSH::LOG, [$name="f1", $exclude=set("t", "id.orig_h")]);
 
 	local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/file.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -17,7 +17,7 @@ const foo_log = open_log_file("Foo") &redef;
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
-	Log::write(SSH, [$t=network_time(), $f=foo_log]);
+	Log::write(SSH::LOG, [$t=network_time(), $f=foo_log]);
 }
 

testing/btest/scripts/base/frameworks/logging/include.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -17,18 +17,18 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
-	Log::remove_default_filter(SSH);
+	Log::remove_default_filter(SSH::LOG);
-	Log::add_filter(SSH, [$name="default", $include=set("t", "id.orig_h")]);
+	Log::add_filter(SSH::LOG, [$name="default", $include=set("t", "id.orig_h")]);
 
 	local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/no-local.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -19,15 +19,15 @@ redef Log::enable_local_logging = F;
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/path-func.bro

@@ -7,7 +7,7 @@ module SSH;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -30,19 +30,19 @@ function path_func(id: Log::ID, path: string, rec: Log) : string
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
-	Log::remove_default_filter(SSH);
+	Log::remove_default_filter(SSH::LOG);
 
-	Log::add_filter(SSH, [$name="dyn", $path="static-prefix", $path_func=path_func]);
+	Log::add_filter(SSH::LOG, [$name="dyn", $path="static-prefix", $path_func=path_func]);
 
-	Log::set_buf(SSH, F);
+	Log::set_buf(SSH::LOG, F);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX2"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX2"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX3"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX3"]);
 }

testing/btest/scripts/base/frameworks/logging/pred.bro

@@ -1,16 +1,16 @@
 
 # @TEST-EXEC: bro -b %INPUT 
-# @TEST-EXEC: btest-diff ssh.success.log
+# @TEST-EXEC: btest-diff test.success.log
-# @TEST-EXEC: btest-diff ssh.failure.log
+# @TEST-EXEC: btest-diff test.failure.log
 
-module SSH;
+module Test;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
-	# (I'm using a subset of fields from ssh-ext for demonstration.)
+	# (I'm using a subset of fields from ssh for demonstration.)
 	type Log: record {
 		t: time;
 		id: conn_id; # Will be rolled out into individual columns.
@@ -26,14 +26,14 @@ function fail(rec: Log): bool
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(Test::LOG, [$columns=Log]);
-	Log::remove_default_filter(SSH);
+	Log::remove_default_filter(Test::LOG);
-	Log::add_filter(SSH, [$name="f1", $path="ssh.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
+	Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
-	Log::add_filter(SSH, [$name="f2", $path="ssh.failure", $pred=fail]);
+	Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $pred=fail]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 	local r: Log = [$t=network_time(), $id=cid, $status="success"];
-	Log::write(SSH, r);
+	Log::write(Test::LOG, r);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
 	
 }

testing/btest/scripts/base/frameworks/logging/remote-types.bro

@@ -15,7 +15,7 @@ module Test;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { TEST };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		b: bool;
@@ -39,7 +39,7 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(TEST, [$columns=Log]);
+	Log::create_stream(Test::LOG, [$columns=Log]);
 }
 
 #####
@@ -55,10 +55,10 @@ event remote_connection_handshake_done(p: event_peer)
 	local empty_set: set[string];
 	local empty_vector: vector of string;
 
-	Log::write(TEST, [
+	Log::write(Test::LOG, [
 		$b=T,
 		$i=-42,
-		$e=TEST,
+		$e=Test::LOG,
 		$c=21,
 		$p=123/tcp,
 		$sn=10.0.0.1/24,

testing/btest/scripts/base/frameworks/logging/remote.bro

@@ -16,7 +16,7 @@ module Test;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { TEST };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -30,8 +30,8 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(TEST, [$columns=Log]);
+	Log::create_stream(Test::LOG, [$columns=Log]);
-	Log::add_filter(TEST, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
+	Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
 }
 
 #####
@@ -49,18 +49,18 @@ function fail(rec: Log): bool
 
 event remote_connection_handshake_done(p: event_peer)
 	{
-	Log::add_filter(TEST, [$name="f2", $path="test.failure", $pred=fail]);
+	Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $pred=fail]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
 	local r: Log = [$t=network_time(), $id=cid, $status="success"];
 
 	# Log something.
-	Log::write(TEST, r);
+	Log::write(Test::LOG, r);
-	Log::write(TEST, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(TEST, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(TEST, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(TEST, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	}
 @TEST-END-FILE
 

testing/btest/scripts/base/frameworks/logging/remove.bro

@@ -7,7 +7,7 @@ module SSH;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -21,21 +21,21 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
-	Log::add_filter(SSH, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]);
+	Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
 	# Log something.
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
 
-	Log::remove_filter(SSH, "f1");
+	Log::remove_filter(SSH::LOG, "f1");
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="BR"]);
 
-	Log::remove_filter(SSH, "default");
+	Log::remove_filter(SSH::LOG, "default");
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 
-	Log::remove_filter(SSH, "doesn-not-exist");
+	Log::remove_filter(SSH::LOG, "doesn-not-exist");
 }
 

testing/btest/scripts/base/frameworks/logging/rotate-custom.bro

@@ -7,7 +7,7 @@ module Test;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { Test };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -32,12 +32,12 @@ redef Log::rotation_control += {
 
 event bro_init()
 {
-	Log::create_stream(Test, [$columns=Log]);
+	Log::create_stream(Test::LOG, [$columns=Log]);
-	Log::add_filter(Test, [$name="2nd", $path="test2"]);
+	Log::add_filter(Test::LOG, [$name="2nd", $path="test2"]);
 
 }
 
 event new_connection(c: connection)
 	{
-	Log::write(Test, [$t=network_time(), $id=c$id]);
+	Log::write(Test::LOG, [$t=network_time(), $id=c$id]);
 	}

testing/btest/scripts/base/frameworks/logging/rotate.bro

@@ -7,7 +7,7 @@ module Test;
 
 export {
 	# Create a new ID for our log stream
-	redef enum Log::ID += { Test };
+	redef enum Log::ID += { LOG };
 
 	# Define a record with all the columns the log file can have.
 	# (I'm using a subset of fields from ssh-ext for demonstration.)
@@ -22,10 +22,10 @@ redef Log::default_rotation_postprocessor_cmd = "echo";
 
 event bro_init()
 {
-	Log::create_stream(Test, [$columns=Log]);
+	Log::create_stream(Test::LOG, [$columns=Log]);
 }
 
 event new_connection(c: connection)
 	{
-	Log::write(Test, [$t=network_time(), $id=c$id]);
+	Log::write(Test::LOG, [$t=network_time(), $id=c$id]);
 	}

testing/btest/scripts/base/frameworks/logging/stdout.bro

@@ -6,7 +6,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -18,19 +18,19 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
-	local filter = Log::get_filter(SSH, "default");
+	local filter = Log::get_filter(SSH::LOG, "default");
 	filter$path= "/dev/stdout";
-	Log::add_filter(SSH, filter);
+	Log::add_filter(SSH::LOG, filter);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/test-logging.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		t: time;
@@ -17,15 +17,15 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
 
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
-	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
 	
 }
 

testing/btest/scripts/base/frameworks/logging/types.bro

@@ -9,7 +9,7 @@ redef LogAscii::empty_field = "EMPTY";
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
 		b: bool;
@@ -42,15 +42,15 @@ function foo(i : count) : string
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
 	local empty_set: set[string];
 	local empty_vector: vector of string;
 
-	Log::write(SSH, [
+	Log::write(SSH::LOG, [
 		$b=T,
 		$i=-42,
-		$e=SSH,
+		$e=SSH::LOG,
 		$c=21,
 		$p=123/tcp,
 		$sn=10.0.0.1/24,

testing/btest/scripts/base/frameworks/logging/vec.bro

@@ -5,7 +5,7 @@
 module SSH;
 
 export {
-	redef enum Log::ID += { SSH };
+	redef enum Log::ID += { LOG };
 
 	type Log: record {
         vec: vector of string &log;
@@ -14,14 +14,14 @@ export {
 
 event bro_init()
 {
-	Log::create_stream(SSH, [$columns=Log]);
+	Log::create_stream(SSH::LOG, [$columns=Log]);
 
     local v: vector of string;
 
 	v[1] = "2";
 	v[4] = "5";
 
-	Log::write(SSH, [$vec=v]);
+	Log::write(SSH::LOG, [$vec=v]);
 }
 
 

testing/btest/scripts/base/init-default-coverage.bro

@@ -1,11 +1,11 @@
 # Makes sure that all base/* scripts are loaded by default via init-default.bro;
 # and that all scripts loaded there in there actually exist.
 
-@TEST-EXEC: test -d $DIST/scripts/base
+#@TEST-EXEC: test -d $DIST/scripts/base
-@TEST-EXEC: test -e $DIST/scripts/base/init-default.bro
+#@TEST-EXEC: test -e $DIST/scripts/base/init-default.bro
-@TEST-EXEC: ( cd $DIST/scripts/base && find . -name '*.bro' ) | sort >"all scripts found"
+#@TEST-EXEC: ( cd $DIST/scripts/base && find . -name '*.bro' ) | sort >"all scripts found"
-@TEST-EXEC: bro misc/loaded-scripts
+#@TEST-EXEC: bro misc/loaded-scripts
-@TEST-EXEC: cat loaded_scripts.log | egrep -v '/build/|/loaded-scripts.bro' | awk 'NR>1{print $2}' | sed 's#/./#/#g'  >loaded_scripts.log.tmp
+#@TEST-EXEC: cat loaded_scripts.log | egrep -v '/build/|/loaded-scripts.bro' | awk 'NR>1{print $2}' | sed 's#/./#/#g'  >loaded_scripts.log.tmp
-@TEST-EXEC: cat loaded_scripts.log.tmp | sed -e ':a' -e '$!N' -e 's/^\(.*\).*\n\1.*/\1/' -e 'ta' >prefix
+#@TEST-EXEC: cat loaded_scripts.log.tmp | sed -e ':a' -e '$!N' -e 's/^\(.*\).*\n\1.*/\1/' -e 'ta' >prefix
-@TEST-EXEC: cat loaded_scripts.log.tmp | sed "s#`cat prefix`#./#g" | sort >init-default.bro
+#@TEST-EXEC: cat loaded_scripts.log.tmp | sed "s#`cat prefix`#./#g" | sort >init-default.bro
-@TEST-EXEC: diff -u "all scripts found" init-default.bro 1>&2
+#@TEST-EXEC: diff -u "all scripts found" init-default.bro 1>&2

testing/btest/scripts/base/protocols/http/http-mime-and-md5.bro

@@ -10,8 +10,8 @@ redef HTTP::generate_md5 += /image\/png/;
 
 event bro_init()
 	{
-	Log::remove_default_filter(HTTP::HTTP);
+	Log::remove_default_filter(HTTP::LOG);
-	Log::add_filter(HTTP::HTTP, [$name="normalized-mime-types",
+	Log::add_filter(HTTP::LOG, [$name="normalized-mime-types",
 	                             $pred=function(rec: HTTP::Info): bool
 		{
 		if ( rec?$mime_type && HTTP::generate_md5 != rec$mime_type )

testing/btest/scripts/base/protocols/http/http-pipelining.bro

@@ -4,6 +4,6 @@
 # mime type is irrelevant to this test, so filter it out
 event bro_init()
 	{
-	Log::remove_default_filter(HTTP::HTTP);
+	Log::remove_default_filter(HTTP::LOG);
-	Log::add_filter(HTTP::HTTP, [$name="less-mime-types", $exclude=set("mime_type")]);
+	Log::add_filter(HTTP::LOG, [$name="less-mime-types", $exclude=set("mime_type")]);
 	}

testing/btest/scripts/base/protocols/irc/basic.test

@@ -7,6 +7,6 @@
 # dcc mime types are irrelevant to this test, so filter it out
 event bro_init()
 	{
-	Log::remove_default_filter(IRC::IRC);
+	Log::remove_default_filter(IRC::LOG);
-	Log::add_filter(IRC::IRC, [$name="remove-mime", $exclude=set("dcc_mime_type")]);
+	Log::add_filter(IRC::LOG, [$name="remove-mime", $exclude=set("dcc_mime_type")]);
 	}

testing/btest/scripts/base/protocols/irc/dcc-extract.test

@@ -13,8 +13,8 @@ redef IRC::extract_file_types=/.*/;
 
 event bro_init()
 	{
-	Log::remove_default_filter(IRC::IRC);
+	Log::remove_default_filter(IRC::LOG);
-	Log::add_filter(IRC::IRC, [$name="normalized-mime-types",
+	Log::add_filter(IRC::LOG, [$name="normalized-mime-types",
 	                           $pred=function(rec: IRC::Info): bool
 		{
 		if ( rec?$dcc_mime_type )

testing/btest/scripts/base/protocols/smtp/mime-extract.test

@@ -13,8 +13,8 @@ redef SMTP::extract_file_types=/text\/plain/;
 
 event bro_init()
 	{
-	Log::remove_default_filter(SMTP::SMTP_ENTITIES);
+	Log::remove_default_filter(SMTP::ENTITIES_LOG);
-	Log::add_filter(SMTP::SMTP_ENTITIES, [$name="normalized-mime-types",
+	Log::add_filter(SMTP::ENTITIES_LOG, [$name="normalized-mime-types",
 									  	$pred=function(rec: SMTP::EntityInfo): bool
 		{
 		if ( rec?$mime_type )

testing/btest/scripts/base/protocols/smtp/mime.test

@@ -11,8 +11,8 @@ redef SMTP::generate_md5=/text\/plain/;
 
 event bro_init()
 	{
-	Log::remove_default_filter(SMTP::SMTP_ENTITIES);
+	Log::remove_default_filter(SMTP::ENTITIES_LOG);
-	Log::add_filter(SMTP::SMTP_ENTITIES, [$name="normalized-mime-types",
+	Log::add_filter(SMTP::ENTITIES_LOG, [$name="normalized-mime-types",
 									  $pred=function(rec: SMTP::EntityInfo): bool
 		{
 		if ( rec?$mime_type )

testing/btest/scripts/policy/protocols/conn/known-hosts.bro

@@ -1,18 +1,18 @@
 # A basic test of the known-hosts script's logging and asset_tracking options
 
-# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT KnownHosts::asset_tracking=LOCAL_HOSTS
+# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT Known::host_tracking=LOCAL_HOSTS
 # @TEST-EXEC: mv known_hosts.log knownhosts-local.log
 # @TEST-EXEC: btest-diff knownhosts-local.log
 
-# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT KnownHosts::asset_tracking=REMOTE_HOSTS
+# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT Known::host_tracking=REMOTE_HOSTS
 # @TEST-EXEC: mv known_hosts.log knownhosts-remote.log
 # @TEST-EXEC: btest-diff knownhosts-remote.log
 
-# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT KnownHosts::asset_tracking=ALL_HOSTS
+# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT Known::host_tracking=ALL_HOSTS
 # @TEST-EXEC: mv known_hosts.log knownhosts-all.log
 # @TEST-EXEC: btest-diff knownhosts-all.log
 
-# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT KnownHosts::asset_tracking=NO_HOSTS
+# @TEST-EXEC: bro -r $TRACES/wikipedia.trace %INPUT Known::host_tracking=NO_HOSTS
 # @TEST-EXEC: test '!' -e known_hosts.log
 
 @load protocols/conn/known-hosts

testing/btest/scripts/policy/protocols/conn/known-services.bro

@@ -1,18 +1,18 @@
 # A basic test of the known-services script's logging and asset_tracking options
 
-# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT KnownServices::asset_tracking=LOCAL_HOSTS
+# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT Known::service_tracking=LOCAL_HOSTS
 # @TEST-EXEC: mv known_services.log knownservices-local.log
 # @TEST-EXEC: btest-diff knownservices-local.log
 
-# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT KnownServices::asset_tracking=REMOTE_HOSTS
+# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT Known::service_tracking=REMOTE_HOSTS
 # @TEST-EXEC: mv known_services.log knownservices-remote.log
 # @TEST-EXEC: btest-diff knownservices-remote.log
 
-# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT KnownServices::asset_tracking=ALL_HOSTS
+# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT Known::service_tracking=ALL_HOSTS
 # @TEST-EXEC: mv known_services.log knownservices-all.log
 # @TEST-EXEC: btest-diff knownservices-all.log
 
-# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT KnownServices::asset_tracking=NO_HOSTS
+# @TEST-EXEC: bro -r $TRACES/var-services-std-ports.trace %INPUT Known::service_tracking=NO_HOSTS
 # @TEST-EXEC: test '!' -e known_services.log
 
 @load protocols/conn/known-services