Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

analyzer: Add analyzer.log for logging violations/confirmations

Browse source 
By default this only logs all the violations, regardless of the
confirmation state (for which there's still dpd.log). It includes
packet, protocol and file analyzers.

This uses options, change handlers and event groups for toggling
the functionality at runtime.

Closes #2031
This commit is contained in:
Arne Welzel 2022-12-15 17:27:10 +01:00
parent e12baf08a7
commit 17d0ade26a
15 changed files with 372 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

5
testing/external/scripts/testing-setup.zeek vendored
View file

@ -22,3 +22,8 @@ hook Telemetry::log_policy(rec: Telemetry::Info, id: Log::ID, filter: Log::Filte
if ( rec$prefix == "zeek" && rec$name == "version_info" )
break;
}
# The IMAP analyzer includes absolute filenames in its error messages,
# exclude it for now from analyzer.log.
# https://github.com/zeek/zeek/issues/2659
redef Analyzer::Logging::ignore_analyzers += { Analyzer::ANALYZER_IMAP };