Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Management framework: allow agents to communicate with cluster nodes

Browse source 
This provides Broker-level plumbing that allows agents to reach out to their
managed Zeek nodes and collect responses.

As a first event, it establishes Management::Node::API::notify_agent_hello,
to notify the agent when the cluster node is ready to communicate.

Also a bit of comment rewording to replace use of "data cluster" with simply
"cluster", to avoid ambiguity with data nodes in SumStats, and expansion of
test-all-policy.zeek and related/dependent tests, since we're introducing new
scripts.
This commit is contained in:
Christian Kreibich 2022-03-23 16:27:28 -07:00
parent d29160e9de
commit 337c7267e0
11 changed files with 100 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

39
scripts/policy/frameworks/management/node/main.zeek Normal file
View file

@ -0,0 +1,39 @@
##! This module provides Management framework functionality that needs to be
##! present in every cluster node to allow Management agents to interact with
##! the cluster nodes they manage.
@load policy/frameworks/management/agent/config
@load policy/frameworks/management/log
@load ./config
module Management::Node;
# Tag our logs correctly
redef Management::Log::role = Management::NODE;
event Broker::peer_added(peer: Broker::EndpointInfo, msg: string)
{
local epi = Management::Agent::endpoint_info();
# If this is the agent peering, notify it that we're ready
if ( peer$network$address == epi$network$address &&
peer$network$bound_port == epi$network$bound_port )
event Management::Node::API::notify_node_hello(Cluster::node);
}
event zeek_init()
{
local epi = Management::Agent::endpoint_info();
Broker::peer(epi$network$address, epi$network$bound_port, Management::connect_retry);
Broker::subscribe(node_topic);
# Events automatically sent to the Management agent.
local events: vector of any = [
Management::Node::API::notify_node_hello
];
for ( i in events )
Broker::auto_publish(node_topic, events[i]);
}