Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Allow logging filters to inherit default path from stream.

Browse source 
This allows the path for the default filter to be specified explicitly
when creating a stream and reduces the need to rely on the default path
function to magically supply the path.

The default path function is now only used if, when a filter is added to
a stream, it has neither a path nor a path function already.

Adapted the existing Log::create_stream calls to explicitly specify a
path value.

Addresses BIT-1324
This commit is contained in:
Jon Siwek 2015-03-19 14:49:55 -05:00
parent 4c00729104
commit 186e67ec1d
45 changed files with 358 additions and 403 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/policy/protocols/conn/known-hosts.bro
View file

@ -38,7 +38,7 @@ export {
event bro_init()
{
Log::create_stream(Known::HOSTS_LOG, [$columns=HostsInfo, $ev=log_known_hosts]);
Log::create_stream(Known::HOSTS_LOG, [$columns=HostsInfo, $ev=log_known_hosts, $path="known_hosts"]);
}
event connection_established(c: connection) &priority=5

3
scripts/policy/protocols/conn/known-services.bro
View file

@ -49,7 +49,8 @@ redef record connection += {
event bro_init() &priority=5
{
Log::create_stream(Known::SERVICES_LOG, [$columns=ServicesInfo,
$ev=log_known_services]);
$ev=log_known_services,
$path="known_services"]);
}
event log_it(ts: time, a: addr, p: port, services: set[string])

2
scripts/policy/protocols/modbus/known-masters-slaves.bro
View file

@ -35,7 +35,7 @@ export {
event bro_init() &priority=5
{
Log::create_stream(Known::MODBUS_LOG, [$columns=ModbusInfo, $ev=log_known_modbus]);
Log::create_stream(Known::MODBUS_LOG, [$columns=ModbusInfo, $ev=log_known_modbus, $path="known_modbus"]);
}
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool)

2
scripts/policy/protocols/modbus/track-memmap.bro
View file

@ -54,7 +54,7 @@ redef record Modbus::Info += {
event bro_init() &priority=5
{
Log::create_stream(Modbus::REGISTER_CHANGE_LOG, [$columns=MemmapInfo]);
Log::create_stream(Modbus::REGISTER_CHANGE_LOG, [$columns=MemmapInfo, $path="modbus_register_change"]);
}
event modbus_read_holding_registers_request(c: connection, headers: ModbusHeaders, start_address: count, quantity: count)

2
scripts/policy/protocols/ssl/known-certs.bro
View file

@ -43,7 +43,7 @@ export {
event bro_init() &priority=5
{
Log::create_stream(Known::CERTS_LOG, [$columns=CertsInfo, $ev=log_known_certs]);
Log::create_stream(Known::CERTS_LOG, [$columns=CertsInfo, $ev=log_known_certs, $path="known_certs"]);
}
event ssl_established(c: connection) &priority=3