Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Measurement framework tests all pass now.

Browse source
This commit is contained in:
Seth Hall 2013-04-01 14:16:37 -04:00
parent 6dc204b385
commit 53f9948b02
22 changed files with 544 additions and 381 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/frameworks/measurement/plugins/sample.bro
View file

@ -8,7 +8,7 @@ export {
samples: count &default=0;
};
redef record Result += {
redef record ResultVal += {
## A sample of something being measured. This is helpful in
## some cases for collecting information to do further detection
## or better logging for forensic purposes.
@ -16,24 +16,24 @@ export {
};
}
redef record Result += {
redef record ResultVal += {
# Internal use only. This is the queue where samples
# are maintained since the queue is self managing for
# the number of samples requested.
sample_queue: Queue::Queue &optional;
};
hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{
if ( r$samples > 0 )
{
if ( ! result?$sample_queue )
result$sample_queue = Queue::init([$max_len=r$samples]);
Queue::push(result$sample_queue, data$str);
if ( ! rv?$sample_queue )
rv$sample_queue = Queue::init([$max_len=r$samples]);
Queue::push(rv$sample_queue, data$str);
}
}
hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
# Merge $sample_queue
if ( rv1?$sample_queue && rv2?$sample_queue )