Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add a weird that gets emitted when strings/containers are over the limits

Browse source
This commit is contained in:
Tim Wojtulewicz 2025-07-31 13:16:16 -07:00
parent 837fde1a08
commit 339d46ae26
14 changed files with 107 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

26
testing/btest/scripts/base/frameworks/logging/field-length-limiting.zeek
View file

@ -3,10 +3,12 @@
# @TEST-EXEC: zeek -b test.zeek %INPUT
# @TEST-EXEC: btest-diff test.log
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff weird.log
# @TEST-START-FILE test.zeek
@load base/frameworks/telemetry
@load base/frameworks/notice/weird
module Test;
@ -19,6 +21,16 @@ export {
};
}
event log_telemetry()
{
local storage_metrics = Telemetry::collect_metrics("zeek", "log_writer_truncated*");
for (i in storage_metrics)
{
local m = storage_metrics[i];
print m$opts$metric_type, m$opts$prefix, m$opts$name, m$label_names, m$label_values, m$value;
}
}
event zeek_init()
{
Log::create_stream(LOG, [$columns=Info, $path="test"]);
@ -36,19 +48,17 @@ event zeek_init()
Log::write(Test::LOG, rec);
local storage_metrics = Telemetry::collect_metrics("zeek", "log_writer_truncated*");
for (i in storage_metrics)
{
local m = storage_metrics[i];
print m$opts$metric_type, m$opts$prefix, m$opts$name, m$label_names, m$label_values, m$value;
}
# Do this as a separate event so the weirds get processed before we log the
# telemetry outout. See the comment below for the first test as to why.
event log_telemetry();
}
# @TEST-END-FILE test.zeek
# Limit the individual fields to 5 bytes, but keep the total maximum large enough that it
# will write all of the fields.
# will write all of the fields. The weird test for this one will be off since it will
# limit the name of the weird. It will pass, but the fields in the log will get truncated
# like they're supposed to.
redef Log::max_field_string_bytes = 5;
# @TEST-START-NEXT