Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

&log keyword, and vector logging.

Browse source 
The &log keyword now operates as discussed:

    - When associated with individual record fields, it defines them
      as being logged.

    - When associated with a complete record type, it defines all fields
      to be logged.

    - When associated with a record extension, it defines all added
      fields to be logged.

    Note that for nested record types, the inner fields must likewise
    be declared with &log. Consequently, conn_id is now declared with
    &log in bro.init.

Vectors are now allowed to be logged and will be recorded as an
ordered set of items.
This commit is contained in:
Robin Sommer 2011-03-28 17:55:41 -07:00
parent 05f2104fec
commit 38a1aa5a34
40 changed files with 307 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/parse.y
View file

@ -3,7 +3,7 @@
// See the file "COPYING" in the main distribution directory for copyright.
%}
%expect 71
%expect 74
%token TOK_ADD TOK_ADD_TO TOK_ADDR TOK_ALARM TOK_ANY
%token TOK_ATENDIF TOK_ATELSE TOK_ATIF TOK_ATIFDEF TOK_ATIFNDEF
@ -24,7 +24,7 @@
%token TOK_ATTR_EXPIRE_CREATE TOK_ATTR_EXPIRE_READ TOK_ATTR_EXPIRE_WRITE
%token TOK_ATTR_PERSISTENT TOK_ATTR_SYNCHRONIZED
%token TOK_ATTR_DISABLE_PRINT_HOOK TOK_ATTR_RAW_OUTPUT TOK_ATTR_MERGEABLE
%token TOK_ATTR_PRIORITY TOK_ATTR_GROUP
%token TOK_ATTR_PRIORITY TOK_ATTR_GROUP TOK_ATTR_LOG
%token TOK_DEBUG
@ -1034,6 +1034,8 @@ attr:
{ $$ = new Attr(ATTR_PRIORITY, $3); }
| TOK_ATTR_GROUP '=' expr
{ $$ = new Attr(ATTR_GROUP, $3); }
| TOK_ATTR_LOG
{ $$ = new Attr(ATTR_LOG); }
;
stmt: