Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Gracefully handle empty/missing shadow file

Browse source 
When a shadow file is empty/missing during rotation, Zeek aborts
with an error message, but if the shadow file was empty, it'll still
be there after the restart, causing an endless restart loop. This
solution gracefully handles the rotation in such cases using the
default file extension and post processing function.
This commit is contained in:
Peter Cullen 2024-04-18 18:39:41 +00:00
parent d566961da5
commit 49123d3a94
1 changed files with 13 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/logging/writers/ascii/Ascii.cc
View file

@ -116,10 +116,14 @@ TEST_CASE("writers.ascii prefix_basename_with") {
static std::optional<LeftoverLog> parse_shadow_log(const std::string& fname) { static std::optional<LeftoverLog> parse_shadow_log(const std::string& fname) {
auto sfname = prefix_basename_with(fname, shadow_file_prefix); auto sfname = prefix_basename_with(fname, shadow_file_prefix);
string default_ext = "." + Ascii::LogExt();
if ( BifConst::LogAscii::gzip_level > 0 )
default_ext += ".gz";
LeftoverLog rval = {}; LeftoverLog rval = {};
rval.filename = fname; rval.filename = fname;
rval.shadow_filename = std::move(sfname); rval.shadow_filename = std::move(sfname);
rval.extension = default_ext;
auto sf_stream = fopen(rval.shadow_filename.data(), "r"); auto sf_stream = fopen(rval.shadow_filename.data(), "r");
@ -165,15 +169,16 @@ static std::optional<LeftoverLog> parse_shadow_log(const std::string& fname) {
auto sf_lines = util::tokenize_string(sf_view, '\n'); auto sf_lines = util::tokenize_string(sf_view, '\n');
if ( sf_lines.size() < 2 ) { if ( sf_lines.size() < 2 ) {
rval.error = util:: reporter->Warning("Found leftover log, '%s', but the associated shadow "
fmt("Found leftover log, '%s', but the associated shadow " " file, '%s', required to process it is invalid: using default "
" file, '%s', required to process it is invalid", " for extension (%s) and post_proc_func",
rval.filename.data(), rval.shadow_filename.data()); rval.filename.data(), rval.shadow_filename.data(),
return rval; default_ext.data());
}
else {
rval.extension = sf_lines[0];
rval.post_proc_func = sf_lines[1];
} }
rval.extension = sf_lines[0];
rval.post_proc_func = sf_lines[1];
struct stat st; struct stat st;