Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Checkpoint commit. This is all a huge mess right now. :)

Browse source
This commit is contained in:
Seth Hall 2012-09-26 10:08:48 -04:00
parent 78401262d0
commit 50e319a417
9 changed files with 495 additions and 314 deletions
Download patch file Download diff file Expand all files Collapse all files

28
scripts/base/frameworks/intel/cluster.bro
View file

@ -17,10 +17,23 @@ export {
};
}
# If this process is not a manager process, we don't want the full metadata
@if ( Cluster::local_node_type() != Cluster::MANAGER )
redef store_metadata = F;
@endif
# Primary intelligence distribution comes from manager.
redef Cluster::manager2worker_events += /Intel::cluster_(new|updated)_item/;
# If a worker finds intelligence and adds it, it should share it back to the manager.
redef Cluster::worker2manager_events += /Intel::cluster_(new|updated)_item/;
redef Cluster::worker2manager_events += /Intel::(match_in_.*_no_items|cluster_(new|updated)_item)/;
@if ( Cluster::local_node_type() == Cluster::MANAGER )
event Intel::match_in_conn_no_items(c: connection, found: Found)
{
local items = lookup(found);
event Intel::match_in_conn(c, found, items);
}
@endif
event Intel::cluster_new_item(item: Intel::Item)
{
@ -38,9 +51,9 @@ event Intel::cluster_updated_item(item: Intel::Item)
event Intel::new_item(item: Intel::Item)
{
# If this is the first time this item has been dispatched,
# send it over the cluster.
if ( item$first_dispatch )
# The cluster manager always rebroadcasts intelligence
if ( Cluster::local_node_type() == Cluster::MANAGER ||
item$first_dispatch )
{
item$first_dispatch = F;
event Intel::cluster_new_item(item);
@ -49,9 +62,10 @@ event Intel::new_item(item: Intel::Item)
event Intel::updated_item(item: Intel::Item)
{
# If this is the first time this item has been dispatched,
# send it over the cluster.
if ( item$first_dispatch )
# If this is the first time this item has been dispatched or this
# is a manager, send it over the cluster.
if ( Cluster::local_node_type() == Cluster::MANAGER ||
item$first_dispatch )
{
item$first_dispatch = F;
event Intel::cluster_updated_item(item);