Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Hook into Broker logs via its new API

Browse source 
The new Broker API allows us to provide a custom logger to Broker that
pulls previously unattainable context information out of Broker to put
them into broker.log for users of Zeek.

Since Broker log events happen asynchronously, we cache them in a queue
and use a flare to notify Zeek of activity. Furthermore, the Broker
manager now implements the `ProcessFd` function to avoid unnecessary
polling of the new log queue. As a side effect, data stores are polled
less as well.
This commit is contained in:
Dominik Charousset 2024-09-29 14:59:35 +02:00 • committed by Dominik Charousset
parent b7b31ebce5
commit 30615f425e
7 changed files with 245 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/broker/store/brokerstore-backend-sqlite-corrupt-delete.zeek
View file

@ -16,6 +16,8 @@
@load base/frameworks/broker/store
redef Broker::log_stderr_severity_level = Broker::LOG_ERROR;
global test_store: opaque of Broker::Store;
global test_table: table[string] of count &broker_store="test_store_42";

10
testing/btest/broker/store/brokerstore-backend-sqlite-corrupt-fail.zeek
View file

@ -5,13 +5,15 @@
# Evil
# @TEST-EXEC: dd if=/dev/zero of=path_to_db.sqlite seek=512 count=32 bs=1
# @TEST-EXEC-FAIL: zeek -b %INPUT >> out
# @TEST-EXEC: zeek -b %INPUT >> out
#
# @TEST-EXEC: grep 'database disk image is malformed' .stderr
# @TEST-EXEC: btest-diff out
@load base/frameworks/broker/store
redef Broker::log_stderr_severity_level = Broker::LOG_ERROR;
global test_store: opaque of Broker::Store;
global test_table: table[string] of count &broker_store="test_store_42";
@ -28,10 +30,10 @@ event zeek_init()
);
if ( Broker::is_closed(test_store) ) {
print("failed to open store");
exit(1);
} else {
print("store is open");
terminate();
return;
}
print("store is open");
local rows = 100;
local i = 0;