Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

logging/ascii: Fix .shadow paths when using LogAscii::logdir

Browse source 
With the introduction of LogAscii::logdir, log filenames can now include
parent directories rather than being plain basenames. Enabling log rotation,
leftover log rotation and setting LogAscii::logdir broke due to not
handling this situation.

This change ensures that .shadow files are placed within the directory where
the respective .log file is created. Previously, the .shadow. (or .tmp.shadow.)
prefix was simply prepended, yielding non-sensical paths such as
.tmp.shadow.foo/bar/packet_filter.log for a logdir of foo/bar.

Additionally, respect LogAscii::logdir when searching for leftover log files
rather than defaulting to the current working directory.

The following quirk exist around LogAscii::logdir, but will be addressed
in a follow-up.

* By default, logs are currently rotated into the working directory of the
  process, rather than staying confined within LogAscii::logdir. One of
  the added tests shows this behavior.
This commit is contained in:
Arne Welzel 2022-06-29 12:59:06 +02:00
parent 8ba44c656a
commit 513ea7e04f
11 changed files with 335 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

131
testing/btest/Baseline/scripts.base.frameworks.logging.rotate-ascii-logdir-leftover-log-rotation/out Normal file
View file

@ -0,0 +1,131 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
test.2011-03-07-03-00-05.log test 11-03-07_03.00.05 11-03-07_04.00.05 0 ascii
test.2011-03-07-04-00-05.log test 11-03-07_04.00.05 11-03-07_05.00.05 0 ascii
test.2011-03-07-05-00-05.log test 11-03-07_05.00.05 11-03-07_06.00.05 0 ascii
test.2011-03-07-06-00-05.log test 11-03-07_06.00.05 11-03-07_07.00.05 0 ascii
test.2011-03-07-07-00-05.log test 11-03-07_07.00.05 11-03-07_08.00.05 0 ascii
test.2011-03-07-08-00-05.log test 11-03-07_08.00.05 11-03-07_09.00.05 0 ascii
test.2011-03-07-09-00-05.log test 11-03-07_09.00.05 11-03-07_10.00.05 0 ascii
test.2011-03-07-10-00-05.log test 11-03-07_10.00.05 11-03-07_11.00.05 0 ascii
test.2011-03-07-11-00-05.log test 11-03-07_11.00.05 11-03-07_12.00.05 0 ascii
test.2011-03-07-12-00-05.log test 11-03-07_12.00.05 11-03-07_12.59.55 1 ascii
> test.2011-03-07-03-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1024
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 0
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-04-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1025
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 1
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-05-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1026
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 2
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-06-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1027
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 3
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-07-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1028
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 4
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-08-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1029
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 5
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-09-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1030
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 6
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-10-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1031
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 7
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-11-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1032
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 8
#close XXXX-XX-XX-XX-XX-XX
> test.2011-03-07-12-00-05.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path test
#open XXXX-XX-XX-XX-XX-XX
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
#types time addr port addr port
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1033
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 9
#close XXXX-XX-XX-XX-XX-XX