mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
Notice suppression clean up and notice/cluster integrtion fixes.
- Worker raised notices are printed a single time by the manager now. - Cluster/notices integration cleaned up. - New tests for cluster/notice integration. - Notice suppression fixes and tests.
This commit is contained in:
parent
acbfb6a425
commit
412cdb16a0
10 changed files with 162 additions and 35 deletions
|
@ -23,10 +23,10 @@ export {
|
|||
const manager_events = /Drop::.*/ &redef;
|
||||
|
||||
## Events raised by the proxies and handled by the manager.
|
||||
const proxy_events = /Notice::notice/ &redef;
|
||||
const proxy_events = /EMPTY/ &redef;
|
||||
|
||||
## Events raised by workers and handled by the manager.
|
||||
const worker_events = /(Notice::notice|TimeMachine::command|Drop::.*)/ &redef;
|
||||
const worker_events = /(TimeMachine::command|Drop::.*)/ &redef;
|
||||
|
||||
## Events sent by the control host (i.e. BroControl) when dynamically
|
||||
## connecting to a running instance to update settings or request data.
|
||||
|
|
|
@ -8,8 +8,6 @@
|
|||
##! This is where the cluster manager sets it's specific settings for other
|
||||
##! frameworks and in the core.
|
||||
|
||||
@load base/frameworks/notice
|
||||
|
||||
@prefixes += cluster-manager
|
||||
|
||||
# Load the script for local site configuration for the manager node.
|
||||
|
@ -23,10 +21,3 @@ redef Log::default_rotation_postprocessor_cmd = "archive-log";
|
|||
|
||||
## We're processing essentially *only* remote events.
|
||||
redef max_remote_events_processed = 10000;
|
||||
|
||||
# Reraise remote notices locally.
|
||||
event Notice::notice(n: Notice::Info)
|
||||
{
|
||||
if ( is_remote_event() )
|
||||
NOTICE(n);
|
||||
}
|
||||
|
|
|
@ -1,5 +1,3 @@
|
|||
@load base/frameworks/notice
|
||||
|
||||
@prefixes += cluster-worker
|
||||
|
||||
# Load the script for local site configuration for the worker nodes.
|
||||
|
@ -17,10 +15,3 @@ redef Log::default_rotation_postprocessor_cmd = "delete-log";
|
|||
## Record all packets into trace file.
|
||||
# TODO: should we really be setting this to T?
|
||||
redef record_all_packets = T;
|
||||
|
||||
# Workers need to have a filter for the notice log which doesn't
|
||||
# do remote logging since we forward the notice event directly.
|
||||
event bro_init()
|
||||
{
|
||||
Log::disable_stream(Notice::LOG);
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue