&log keyword, and vector logging.

The &log keyword now operates as discussed:

    - When associated with individual record fields, it defines them
      as being logged.

    - When associated with a complete record type, it defines all fields
      to be logged.

    - When associated with a record extension, it defines all added
      fields to be logged.

    Note that for nested record types, the inner fields must likewise
    be declared with &log. Consequently, conn_id is now declared with
    &log in bro.init.

Vectors are now allowed to be logged and will be recorded as an
ordered set of items.

aux/binpac

@@ -1 +1 @@
-Subproject commit c3c7ef0dfddb0746d3762e41086ba42928e68483
+Subproject commit 26d02716f9090651f319a4bfdf8ede49b3a7b53a

aux/bro-aux

@@ -1 +1 @@
-Subproject commit 98f92eeb40281045159097764abddc428fb49bf2
+Subproject commit 7e50bac938af1831ecf9660159145a3c2e77e13d

aux/broccoli

@@ -1 +1 @@
-Subproject commit 48d473398e577893b6c7f77d605ccdf266a2f93b
+Subproject commit 9332ab3467191ac22be09d6941ebd469e7a334d0

aux/broctl

@@ -1 +1 @@
-Subproject commit 532dcd5aa51c8b29b2d71cd37e1d7c21e33cc715
+Subproject commit 06b74a0f23767c8345ed146657120aba812f6764

aux/btest

@@ -1 +1 @@
-Subproject commit a2b04952ae91dcd27d5e68a42d5d26c291ecb1f5
+Subproject commit acf25f34ab48568f5db919c9e3505ed319daa4e5

policy/bro.init

@@ -21,7 +21,7 @@ type conn_id: record {
 	orig_p: port;
 	resp_h: addr;
 	resp_p: port;
-};
+} &log;
 
 type icmp_conn: record {
 	orig_h: addr;

src/Attr.cc

@@ -7,6 +7,7 @@
 #include "Attr.h"
 #include "Expr.h"
 #include "Serializer.h"
+#include "LogMgr.h"
 
 const char* attr_name(attr_tag t)
 	{
@@ -332,6 +333,11 @@ void Attributes::CheckAttr(Attr* a)
 			}
 		break;
 
+	case ATTR_LOG:
+		if ( ! LogVal::IsCompatibleType(type) )
+			Error("&log applied to a type that cannot be logged");
+		break;
+
 	default:
 		BadTag("Attributes::CheckAttr", attr_name(a->Tag()));
 	}

src/Attr.h

@@ -35,6 +35,7 @@ typedef enum {
 	ATTR_MERGEABLE,
 	ATTR_PRIORITY,
 	ATTR_GROUP,
+	ATTR_LOG,
 	ATTR_TRACKED,	// hidden attribute, tracked by NotifierRegistry
 #define NUM_ATTRS (int(ATTR_TRACKED) + 1)
 } attr_tag;

src/ID.cc

@@ -235,6 +235,25 @@ void ID::UpdateValAttrs()
 				}
 			}
 		}
+
+	if ( Type()->Tag() == TYPE_RECORD )
+		{
+		Attr* attr = attrs->FindAttr(ATTR_LOG);
+		if ( attr )
+			{
+			// Apply &log to all record fields.
+			RecordType* rt = Type()->AsRecordType();
+			for ( int i = 0; i < rt->NumFields(); ++i )
+				{
+				TypeDecl* fd = rt->FieldDecl(i);
+
+				if ( ! fd->attrs )
+					fd->attrs = new Attributes(new attr_list, rt->FieldType(i));
+
+				fd->attrs->AddAttr(new Attr(ATTR_LOG));
+				}
+			}
+		}
 	}
 
 void ID::AddAttrs(Attributes* a)

src/LogMgr.cc

@@ -75,6 +75,14 @@ LogVal::~LogVal()
 
 		delete [] val.set_val.vals;
 		}
+
+	if ( type == TYPE_VECTOR && present )
+		{
+		for ( int i = 0; i < val.vector_val.size; i++ )
+			delete val.vector_val.vals[i];
+
+		delete [] val.vector_val.vals;
+		}
 	}
 
 bool LogVal::IsCompatibleType(BroType* t, bool atomic_only)
@@ -112,6 +120,14 @@ bool LogVal::IsCompatibleType(BroType* t, bool atomic_only)
 		return IsCompatibleType(t->AsSetType()->Indices()->PureType());
 		}
 
+	case TYPE_VECTOR:
+		{
+		if ( atomic_only )
+			return false;
+
+		return IsCompatibleType(t->AsVectorType()->YieldType());
+		}
+
 	default:
 		return false;
 	}
@@ -149,7 +165,7 @@ bool LogVal::Read(SerializationFormat* fmt)
 			&& fmt->Read(&net[2], "net2")
 			&& fmt->Read(&net[3], "net3")
 			&& fmt->Read(&val.subnet_val.width, "width")) )
-			return false;
+		    	return false;
 
 #ifdef BROv6
 		val.subnet_val.net[0] = net[0];
@@ -212,8 +228,25 @@ bool LogVal::Read(SerializationFormat* fmt)
 		return true;
 		}
 
+	case TYPE_VECTOR:
+		{
+		if ( ! fmt->Read(&val.vector_val.size, "vector_size") )
+			return false;
+
+		val.vector_val.vals = new LogVal* [val.vector_val.size];
+
+		for ( int i = 0; i < val.vector_val.size; ++i )
+			{
+			val.vector_val.vals[i] = new LogVal;
+			if ( ! val.vector_val.vals[i]->Read(fmt) )
+				return false;
+			}
+
+		return true;
+		}
+
 	default:
-		internal_error(::fmt("unsupported type %s in LogVal::Write", type_name(type)));
+		internal_error("unsupported type %s in LogVal::Write", type_name(type));
 	}
 
 	return false;
@@ -292,8 +325,22 @@ bool LogVal::Write(SerializationFormat* fmt) const
 		return true;
 		}
 
+	case TYPE_VECTOR:
+		{
+		if ( ! fmt->Write(val.vector_val.size, "vector_size") )
+			return false;
+
+		for ( int i = 0; i < val.vector_val.size; ++i )
+			{
+			if ( ! val.vector_val.vals[i]->Write(fmt) )
+				return false;
+			}
+
+		return true;
+		}
+
 	default:
-		internal_error(::fmt("unsupported type %s in LogVal::REad", type_name(type)));
+		internal_error("unsupported type %s in LogVal::REad", type_name(type));
 	}
 
 	return false;
@@ -379,13 +426,26 @@ bool LogMgr::CreateStream(EnumVal* id, RecordVal* sval)
 
 	RecordType* columns = sval->Lookup(rtype->FieldOffset("columns"))->AsType()->AsTypeType()->Type()->AsRecordType();
 
+	bool log_attr_present = false;
+
 	for ( int i = 0; i < columns->NumFields(); i++ )
 		{
+		if ( ! (columns->FieldDecl(i)->FindAttr(ATTR_LOG)) )
+		    continue;
+
 		if ( ! LogVal::IsCompatibleType(columns->FieldType(i)) )
 			{
 			run_time("type of field '%s' is not support for logging output", columns->FieldName(i));
 			return false;
 			}
+
+		log_attr_present = true;
+		}
+
+	if ( ! log_attr_present )
+		{
+		run_time("logged record type does not have any &log attributes");
+		return false;
 		}
 
 	Val* event_val = sval->Lookup(rtype->FieldOffset("ev"));
@@ -473,12 +533,16 @@ bool LogMgr::DisableStream(EnumVal* id)
 	}
 
 // Helper for recursive record field unrolling.
-bool LogMgr::TraverseRecord(Filter* filter, RecordType* rt, TableVal* include, TableVal* exclude, string path, list<int> indices)
+bool LogMgr::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt, TableVal* include, TableVal* exclude, string path, list<int> indices)
 	{
 	for ( int i = 0; i < rt->NumFields(); ++i )
 		{
 		BroType* t = rt->FieldType(i);
 
+		// Ignore if &log not specified.
+		if ( ! rt->FieldDecl(i)->FindAttr(ATTR_LOG) )
+			continue;
+
 		list<int> new_indices = indices;
 		new_indices.push_back(i);
 
@@ -496,16 +560,22 @@ bool LogMgr::TraverseRecord(Filter* filter, RecordType* rt, TableVal* include, T
 			if ( t->Tag() == TYPE_RECORD )
 				{
 				// Recurse.
-				if ( ! TraverseRecord(filter, t->AsRecordType(), include, exclude, new_path, new_indices) )
+				if ( ! TraverseRecord(stream, filter, t->AsRecordType(), include, exclude, new_path, new_indices) )
 					return false;
 
 				continue;
 				}
+
 			else if ( t->Tag() == TYPE_TABLE && t->AsTableType()->IsSet() )
 				{
 				// That's ok, handle it with all the other types below.
 				}
 
+			else if ( t->Tag() == TYPE_VECTOR )
+				{
+				// That's ok, handle it with all the other types below.
+				}
+
 			else {
 				run_time("unsupported field type for log column");
 				return false;
@@ -595,7 +665,7 @@ bool LogMgr::AddFilter(EnumVal* id, RecordVal* fval)
 
 	filter->num_fields = 0;
 	filter->fields = 0;
-	if ( ! TraverseRecord(filter, stream->columns, include ? include->AsTableVal() : 0, exclude ? exclude->AsTableVal() : 0, "", list<int>()) )
+	if ( ! TraverseRecord(stream, filter, stream->columns, include ? include->AsTableVal() : 0, exclude ? exclude->AsTableVal() : 0, "", list<int>()) )
 		return false;
 
 	// Get the path for the filter.
@@ -780,7 +850,7 @@ bool LogMgr::Write(EnumVal* id, RecordVal* columns)
 
 		// Alright, can do the write now.
 
-		LogVal** vals = RecordToFilterVals(filter, columns);
+		LogVal** vals = RecordToFilterVals(stream, filter, columns);
 
 		if ( filter->remote )
 			remote_serializer->SendLogWrite(stream->id, filter->writer, path, filter->num_fields, vals);
@@ -801,9 +871,15 @@ bool LogMgr::Write(EnumVal* id, RecordVal* columns)
 	return true;
 	}
 
-LogVal* LogMgr::ValToLogVal(Val* val)
+LogVal* LogMgr::ValToLogVal(Val* val, BroType* ty)
 	{
-	LogVal* lval = new LogVal(val->Type()->Tag());
+	if ( ! ty )
+		ty = val->Type();
+
+	if ( ! val )
+		return new LogVal(ty->Tag(), false);
+
+	LogVal* lval = new LogVal(ty->Tag());
 
 	switch ( lval->type ) {
 	case TYPE_BOOL:
@@ -864,14 +940,26 @@ LogVal* LogMgr::ValToLogVal(Val* val)
 		break;
 		}
 
-		default:
-			internal_error("unsupported type for log_write");
+	case TYPE_VECTOR:
+		{
+		VectorVal* vec = val->AsVectorVal();
+		lval->val.vector_val.size = vec->Size();
+		lval->val.vector_val.vals = new LogVal* [lval->val.vector_val.size];
+
+		for ( int i = 0; i < lval->val.vector_val.size; i++ )
+			lval->val.vector_val.vals[i] = ValToLogVal(vec->Lookup(VECTOR_MIN + i), vec->Type()->YieldType());
+
+		break;
 		}
 
+	default:
+		internal_error("unsupported type for log_write");
+	}
+
 	return lval;
 	}
 
-LogVal** LogMgr::RecordToFilterVals(Filter* filter, RecordVal* columns)
+LogVal** LogMgr::RecordToFilterVals(Stream* stream, Filter* filter, RecordVal* columns)
 	{
 	LogVal** vals = new LogVal*[filter->num_fields];
 
@@ -921,7 +1009,7 @@ LogWriter* LogMgr::CreateWriter(EnumVal* id, EnumVal* writer, string path, int n
 
 	// Need to instantiate a new writer.
 
-    LogWriterDefinition* ld = log_writers;
+	LogWriterDefinition* ld = log_writers;
 
 	while ( true )
 		{

src/LogMgr.h

@@ -37,15 +37,17 @@ struct LogVal {
 	// The following union is a subset of BroValUnion, including only the
 	// atomic types.
 	struct set_t { bro_int_t size; LogVal** vals; };
+	typedef set_t vec_t;
 
  	union _val {
 		bro_int_t int_val;
 		bro_uint_t uint_val;
 		addr_type addr_val;
 		subnet_type subnet_val;
-    	double double_val;
+		double double_val;
 		string* string_val;
 		set_t set_val;
+		vec_t vector_val;
 	} val;
 
 	LogVal(TypeTag arg_type = TYPE_ERROR, bool arg_present = true) : type(arg_type), present(arg_present)	{}
@@ -75,11 +77,11 @@ public:
     bool EnableStream(EnumVal* id);
     bool DisableStream(EnumVal* id);
     bool AddFilter(EnumVal* id, RecordVal* filter);
-	bool RemoveFilter(EnumVal* id, StringVal* name);
+    bool RemoveFilter(EnumVal* id, StringVal* name);
     bool RemoveFilter(EnumVal* id, string name);
     bool Write(EnumVal* id, RecordVal* columns);
-	bool SetBuf(EnumVal* id, bool enabled); // Changes the state for all writers for that stream.
-	bool Flush(EnumVal* id); // Flushes all writers for the stream.
+    bool SetBuf(EnumVal* id, bool enabled); // Changes the state for all writers for that stream.
+    bool Flush(EnumVal* id); // Flushes all writers for the stream.
 
 protected:
     friend class LogWriter;
@@ -101,9 +103,9 @@ private:
 	struct Stream;
 	struct WriterInfo;
 
-	bool TraverseRecord(Filter* filter, RecordType* rt, TableVal* include, TableVal* exclude, string path, list<int> indices);
-	LogVal* ValToLogVal(Val* val);
-	LogVal** RecordToFilterVals(Filter* filter, RecordVal* columns);
+	bool TraverseRecord(Stream* stream, Filter* filter, RecordType* rt, TableVal* include, TableVal* exclude, string path, list<int> indices);
+	LogVal* ValToLogVal(Val* val, BroType* ty = 0);
+	LogVal** RecordToFilterVals(Stream* stream, Filter* filter, RecordVal* columns);
 	Stream* FindStream(EnumVal* id);
 	void RemoveDisabledWriters(Stream* stream);
 	void InstallRotationTimer(WriterInfo* winfo);

src/LogWriterAscii.cc

@@ -167,6 +167,26 @@ bool LogWriterAscii::DoWriteOne(ODesc* desc, LogVal* val, const LogField* field)
 		break;
 		}
 
+	case TYPE_VECTOR:
+		{
+		if ( ! val->val.vector_val.size )
+			{
+			desc->AddN(empty_field, empty_field_len);
+			break;
+			}
+
+		for ( int j = 0; j < val->val.vector_val.size; j++ )
+			{
+			if ( j > 0 )
+				desc->AddN(set_separator, set_separator_len);
+
+			if ( ! DoWriteOne(desc, val->val.vector_val.vals[j], field) )
+				return false;
+			}
+
+		break;
+		}
+
 	default:
 		Error(Fmt("unsupported field format %d for %s", val->type, field->name.c_str()));
 		return false;

src/parse.y

@@ -3,7 +3,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 %}
 
-%expect 71
+%expect 74
 
 %token TOK_ADD TOK_ADD_TO TOK_ADDR TOK_ALARM TOK_ANY
 %token TOK_ATENDIF TOK_ATELSE TOK_ATIF TOK_ATIFDEF TOK_ATIFNDEF
@@ -24,7 +24,7 @@
 %token TOK_ATTR_EXPIRE_CREATE TOK_ATTR_EXPIRE_READ TOK_ATTR_EXPIRE_WRITE
 %token TOK_ATTR_PERSISTENT TOK_ATTR_SYNCHRONIZED
 %token TOK_ATTR_DISABLE_PRINT_HOOK TOK_ATTR_RAW_OUTPUT TOK_ATTR_MERGEABLE
-%token TOK_ATTR_PRIORITY TOK_ATTR_GROUP
+%token TOK_ATTR_PRIORITY TOK_ATTR_GROUP TOK_ATTR_LOG
 
 %token TOK_DEBUG
 
@@ -1034,6 +1034,8 @@ attr:
 			{ $$ = new Attr(ATTR_PRIORITY, $3); }
 	|	TOK_ATTR_GROUP '=' expr
 			{ $$ = new Attr(ATTR_GROUP, $3); }
+	|	TOK_ATTR_LOG
+			{ $$ = new Attr(ATTR_LOG); }
 	;
 
 stmt:

src/scan.l

@@ -196,6 +196,7 @@ when	return TOK_WHEN;
 &encrypt	return TOK_ATTR_ENCRYPT;
 &expire_func	return TOK_ATTR_EXPIRE_FUNC;
 &group		return TOK_ATTR_GROUP;
+&log		return TOK_ATTR_LOG;
 &mergeable	return TOK_ATTR_MERGEABLE;
 &optional	return TOK_ATTR_OPTIONAL;
 &persistent	return TOK_ATTR_PERSISTENT;

testing/btest/Baseline/logging.attr/ssh.log

@@ -0,0 +1,6 @@
+# status	country
+success	unknown
+failure	US
+failure	UK
+success	BR
+failure	MX

testing/btest/Baseline/logging.remote-types/receiver.ssh.log

@@ -1,2 +1,2 @@
-# b	i	e	c	p	sn	n	a	d	t	iv	s	sc	ss	se
-T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1299727902.65854	100.0	hurz	4,1,3,2	CC,BB,AA	EMPTY
+# b	i	e	c	p	sn	n	a	d	t	iv	s	sc	ss	se	vc	ve
+T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1301360085.98852	100.0	hurz	4,1,3,2	CC,BB,AA	EMPTY	10,20,30	EMPTY

testing/btest/Baseline/logging.rotate-custom/out

@@ -68,8 +68,6 @@
 # t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
 1299499205.0	10.0.0.1	20	10.0.0.2	1033
 1299502795.0	10.0.0.2	20	10.0.0.3	9
-> test.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
 > test2-11-03-06_19.00.05.log
 # t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
 1299466805.0	10.0.0.1	20	10.0.0.2	1024
@@ -132,3 +130,5 @@
 1299502795.0	10.0.0.2	20	10.0.0.3	9
 > test2.log
 # t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
+> test.log
+# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p

testing/btest/Baseline/logging.types/ssh.log

@@ -1,2 +1,2 @@
-# b	i	e	c	p	sn	n	a	d	t	iv	s	sc	ss	se
-T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1299727493.47095	100.0	hurz	4,1,3,2	CC,BB,AA	EMPTY
+# b	i	e	c	p	sn	n	a	d	t	iv	s	sc	ss	se	vc	ve
+T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1301359781.8203	100.0	hurz	4,1,3,2	CC,BB,AA	EMPTY	10,20,30	EMPTY

testing/btest/Baseline/logging.vec/ssh.log

@@ -0,0 +1,2 @@
+# vec
+-,2,-,-,5

testing/btest/logging/adapt-filter.bro

@@ -18,7 +18,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/ascii-empty.bro

@@ -19,7 +19,7 @@ export {
 		status: string &optional;
 		country: string &default="unknown";
 		b: bool &optional;
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/ascii-escape.bro

@@ -14,7 +14,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/ascii-options.bro

@@ -16,7 +16,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/attr-extend.bro

@@ -0,0 +1,37 @@
+#
+# @TEST-EXEC: bro %INPUT
+# @TEST-EXEC: btest-diff ssh.log
+
+module SSH;
+
+export {
+	redef enum Log::ID += { SSH };
+
+	type Log: record {
+		t: time;
+		id: conn_id;
+		status: string &optional &log;
+		country: string &default="unknown" &log;
+	};
+}
+
+redef Log += record {
+	a1: count &log;
+	a2: count;
+};
+
+redef Log += record {
+	b1: count;
+	b2: count;
+} &log;
+
+
+event bro_init()
+{
+	Log::create_stream(SSH, [$columns=Log]);
+
+    local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
+
+	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", a1=1, a2=2, a3=3, a4=4]);
+}
+

testing/btest/logging/attr.bro

@@ -0,0 +1,31 @@
+#
+# @TEST-EXEC: bro %INPUT
+# @TEST-EXEC: btest-diff ssh.log
+
+module SSH;
+
+export {
+	redef enum Log::ID += { SSH };
+
+	type Log: record {
+		t: time;
+		id: conn_id;
+		status: string &optional &log;
+		country: string &default="unknown" &log;
+	};
+}
+
+event bro_init()
+{
+	Log::create_stream(SSH, [$columns=Log]);
+
+    local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
+
+	Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
+	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
+	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
+	Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
+	Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
+	
+}
+

testing/btest/logging/disable-stream.bro

@@ -12,7 +12,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/empty-event.bro

@@ -12,7 +12,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 global log_ssh: event(rec: Log);

testing/btest/logging/events.bro

@@ -17,7 +17,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 global ssh_log: event(rec: Log);

testing/btest/logging/no-local.bro

@@ -12,7 +12,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 redef Log::enable_local_logging = F;

testing/btest/logging/path-func.bro

@@ -18,7 +18,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 global c = -1;

testing/btest/logging/pred.bro

@@ -18,7 +18,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 function fail(rec: Log): bool

testing/btest/logging/remote-types.bro

@@ -35,7 +35,9 @@ export {
 		sc: set[count];
 		ss: set[string];
 		se: set[string];
-	};
+		vc: vector of count;
+		ve: vector of string;
+	} &log;
 }
 
 event bro_init()
@@ -54,6 +56,7 @@ module SSH;
 event remote_connection_handshake_done(p: event_peer)
 	{
 	local empty_set: set[string];
+	local empty_vector: vector of string;
 
 	Log::write(SSH, [
 		$b=T,
@@ -70,7 +73,9 @@ event remote_connection_handshake_done(p: event_peer)
 		$s="hurz",
 		$sc=set(1,2,3,4),
 		$ss=set("AA", "BB", "CC"),
-		$se=empty_set
+		$se=empty_set,
+		$vc=vector(10, 20, 30),
+		$ve=empty_vector
 		]);
 	}
 @TEST-END-FILE

testing/btest/logging/remote.bro

@@ -25,7 +25,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/remove.bro

@@ -16,7 +16,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/rotate-custom.bro

@@ -1,6 +1,6 @@
 #
 # @TEST-EXEC: bro -r %DIR/rotation.trace %INPUT >out
-# @TEST-EXEC: for i in test*.log; do printf '> %s\n' $i; cat $i; done >>out
+# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out
 # @TEST-EXEC: btest-diff out
 
 module Test;
@@ -14,7 +14,7 @@ export {
 	type Log: record {
 		t: time;
 		id: conn_id; # Will be rolled out into individual columns.
-	};
+	} &log;
 }
 
 redef Log::default_rotation_interval = 1hr;

testing/btest/logging/rotate.bro

@@ -14,7 +14,7 @@ export {
 	type Log: record {
 		t: time;
 		id: conn_id; # Will be rolled out into individual columns.
-	};
+	} &log;
 }
 
 redef Log::default_rotation_interval = 1hr;

testing/btest/logging/stdout.bro

@@ -13,7 +13,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/test-logging.bro

@@ -12,7 +12,7 @@ export {
 		id: conn_id; # Will be rolled out into individual columns.
 		status: string &optional;
 		country: string &default="unknown";
-	};
+	} &log;
 }
 
 event bro_init()

testing/btest/logging/types.bro

@@ -27,7 +27,9 @@ export {
 		sc: set[count];
 		ss: set[string];
 		se: set[string];
-	};
+		vc: vector of count;
+		ve: vector of string;
+	} &log;
 }
 
 event bro_init()
@@ -35,6 +37,7 @@ event bro_init()
 	Log::create_stream(SSH, [$columns=Log]);
 
 	local empty_set: set[string];
+	local empty_vector: vector of string;
 
 	Log::write(SSH, [
 		$b=T,
@@ -51,7 +54,9 @@ event bro_init()
 		$s="hurz",
 		$sc=set(1,2,3,4),
 		$ss=set("AA", "BB", "CC"),
-		$se=empty_set
+		$se=empty_set,
+		$vc=vector(10, 20, 30),
+		$ve=empty_vector
 		]);
 }
 

testing/btest/logging/vec.bro

@@ -0,0 +1,27 @@
+#
+# @TEST-EXEC: bro %INPUT
+# @TEST-EXEC: btest-diff ssh.log
+
+module SSH;
+
+export {
+	redef enum Log::ID += { SSH };
+
+	type Log: record {
+        vec: vector of string &log;
+	};
+}
+
+event bro_init()
+{
+	Log::create_stream(SSH, [$columns=Log]);
+
+    local v: vector of string;
+
+	v[2] = "2";
+	v[5] = "5";
+
+	Log::write(SSH, [$vec=v]);
+}
+
+