mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 01:58:20 +00:00
completely change interface again.
compiles, not really tested. basic test works 70% of the time, coredumps in the other 30 - but was not easy to debug on a first glance (most interestingly the crash happens in the logging framework - I wonder how that works). Other tests are not adjusted to the new interface yet.
This commit is contained in:
parent
b4e6971aab
commit
57ffe1be77
14 changed files with 403 additions and 1072 deletions
|
@ -14,10 +14,6 @@ redef InputAscii::empty_field = "EMPTY";
|
|||
|
||||
module A;
|
||||
|
||||
export {
|
||||
redef enum Input::ID += { INPUT };
|
||||
}
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
@ -45,12 +41,10 @@ global servers: table[int] of Val = table();
|
|||
event bro_init()
|
||||
{
|
||||
# first read in the old stuff into the table...
|
||||
Input::create_stream(A::INPUT, [$source="input.log"]);
|
||||
Input::add_tablefilter(A::INPUT, [$name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove_tablefilter(A::INPUT, "ssh");
|
||||
Input::remove_stream(A::INPUT);
|
||||
Input::add_table([$source="input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("ssh");
|
||||
}
|
||||
|
||||
event Input::update_finished(id: Input::ID) {
|
||||
event Input::update_finished(id: string) {
|
||||
print servers;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue