Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote branch 'origin/topic/bernhard/log-set-description'

Browse source 
* origin/topic/bernhard/log-set-description:
  update baseline
  make LogWriter output the type of data stored inside a set or vector.
This commit is contained in:
Robin Sommer 2011-12-18 16:48:24 -08:00
commit 5ee605f244
7 changed files with 28 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/LogMgr.cc
View file

@ -81,16 +81,18 @@ struct LogMgr::Stream {
bool LogField::Read(SerializationFormat* fmt)
{
int t;
int st;
bool success = (fmt->Read(&name, "name") && fmt->Read(&t, "type"));
bool success = (fmt->Read(&name, "name") && fmt->Read(&t, "type") && fmt->Read(&st, "subtype") );
type = (TypeTag) t;
subtype = (TypeTag) st;
return success;
}
bool LogField::Write(SerializationFormat* fmt) const
{
return (fmt->Write(name, "name") && fmt->Write((int)type, "type"));
return (fmt->Write(name, "name") && fmt->Write((int)type, "type") && fmt->Write((int)subtype, "subtype"));
}
LogVal::~LogVal()
@ -707,6 +709,14 @@ bool LogMgr::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
LogField* field = new LogField();
field->name = new_path;
field->type = t->Tag();
if ( field->type == TYPE_TABLE )
{
field->subtype = t->AsSetType()->Indices()->PureType()->Tag();
}
else if ( field->type == TYPE_VECTOR )
{
field->subtype = t->AsVectorType()->YieldType()->Tag();
}
filter->fields[filter->num_fields - 1] = field;
}

6
src/LogMgr.h
View file

@ -15,10 +15,12 @@ class SerializationFormat;
struct LogField {
string name;
TypeTag type;
// inner type of sets
TypeTag subtype;
LogField() { }
LogField() { subtype = TYPE_VOID; }
LogField(const LogField& other)
: name(other.name), type(other.type) { }
: name(other.name), type(other.type), subtype(other.subtype) { }
// (Un-)serialize.
bool Read(SerializationFormat* fmt);

6
src/LogWriterAscii.cc
View file

@ -111,6 +111,12 @@ bool LogWriterAscii::DoInit(string path, int num_fields,
const LogField* field = fields[i];
names += field->name;
types += type_name(field->type);
if ( (field->type == TYPE_TABLE) || (field->type == TYPE_VECTOR) )
{
types += "[";
types += type_name(field->subtype);
types += "]";
}
}
if ( ! (WriteHeaderField("fields", names)

2
testing/btest/Baseline/scripts.base.frameworks.logging.ascii-escape-odd-url/http.log
View file

@ -4,5 +4,5 @@
#unset_field \x2d
#path http
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file
#types time string addr port addr port count string string string string string count count count string count string string table string string table string string file
#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file
1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 1 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 346 404 Not Found - - - - - - - text/html - -

7
testing/btest/Baseline/scripts.base.frameworks.logging.remote-types/receiver.test.log
View file

@ -1,8 +1,5 @@
#separator \x09
#set_separator \x2c
#empty_field \x45\x4d\x50\x54\x59
#unset_field \x2d
#path test
#fields b i e c p sn a d t iv s sc ss se vc ve
#types bool int enum count port subnet addr double time interval string table table table vector vector
T -42 Test::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1323275900.286451 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string]
T -42 Test::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1323292199.700588 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY

7
testing/btest/Baseline/scripts.base.frameworks.logging.types/ssh.log
View file

@ -1,8 +1,5 @@
#separator \x09
#set_separator \x2c
#empty_field \x45\x4d\x50\x54\x59
#unset_field \x2d
#path ssh
#fields b i e c p sn a d t iv s sc ss se vc ve f
#types bool int enum count port subnet addr double time interval string table table table vector vector func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1323276169.782634 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
#types bool int enum count port subnet addr double time interval string table[count] table[string] table[string] vector[count] vector[string] func
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1323292210.836187 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}

2
testing/btest/Baseline/scripts.base.frameworks.logging.vec/ssh.log
View file

@ -4,5 +4,5 @@
#unset_field \x2d
#path ssh
#fields vec
#types vector
#types vector[string]
-,2,-,-,5