mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 21:48:21 +00:00
Event: Deprecate default network timestamp metadata
This deprecates the Event constructor and the ``ts`` parameter of Enqueue() Instead, versions are introduced that take a detail::MetadataVectorPtr which can hold the network timestamp metadata and is meant to be allocated by the caller instead of automatically during Enqueue() or within the Event constructor. This also introduces a BifConst ``EventMetadata::add_network_timestamp`` to opt-in adding network timestamps to events globally. It's disabled by default as there are not a lot of known use cases that need this.
This commit is contained in:
parent
12c523f3f7
commit
53b0f0ad64
13 changed files with 167 additions and 10 deletions
|
@ -1,6 +1,8 @@
|
|||
# @TEST-EXEC: zeek -b -r $TRACES/ticks-dns-1hr.pcap %INPUT > out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
redef EventMetadata::add_network_timestamp = T;
|
||||
|
||||
global runs = 0;
|
||||
|
||||
event test(schedule_time: time)
|
||||
|
|
|
@ -4,6 +4,8 @@
|
|||
# Note: We use a PCAP with DNS queries only so that we have a single packet per
|
||||
# time step. Thus the run loop will be executed only once per time step.
|
||||
|
||||
redef EventMetadata::add_network_timestamp = T;
|
||||
|
||||
global runs = -1;
|
||||
|
||||
event test(depth: count)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue