Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Lots of infracstructure for the new logging framework.

Browse source 
This pretty much follows the proposal on the projects page.

It includes:

    - A new LogMgr, maintaining the set of writers.

    - The abstract LogWriter API.

    - An initial implementation in the form of LogWriterAscii
      producing tab-separated columns.

Note that things are only partially working right now, things are
subject to change, and it's all not much tested at all. That's why I'm
creating separate branch for now.

Example:

     bro -B logging test-logging && cat debug.log
    1298063168.409852/1298063168.410368 [logging] Created new logging stream 'SSH::LOG_SSH'
    1298063168.409852/1298063168.410547 [logging] Created new filter 'default' for stream 'SSH::LOG_SSH'
    1298063168.409852/1298063168.410564 [logging]    writer    : Ascii
    1298063168.409852/1298063168.410574 [logging]    path      : ssh_log_ssh
    1298063168.409852/1298063168.410584 [logging]    path_func : not set
    1298063168.409852/1298063168.410594 [logging]    event     : not set
    1298063168.409852/1298063168.410604 [logging]    pred      : not set
    1298063168.409852/1298063168.410614 [logging]    field          t: time
    1298063168.409852/1298063168.410625 [logging]    field  id.orig_h: addr
    1298063168.409852/1298063168.410635 [logging]    field  id.orig_p: port
    1298063168.409852/1298063168.410645 [logging]    field  id.resp_h: addr
    1298063168.409852/1298063168.410655 [logging]    field  id.resp_p: port
    1298063168.409852/1298063168.410665 [logging]    field     status: string
    1298063168.409852/1298063168.410675 [logging]    field    country: string
    1298063168.409852/1298063168.410817 [logging] Wrote record to filter 'default' on stream 'SSH::LOG_SSH'
    1298063168.409852/1298063168.410865 [logging] Wrote record to filter 'default' on stream 'SSH::LOG_SSH'
    1298063168.409852/1298063168.410906 [logging] Wrote record to filter 'default' on stream 'SSH::LOG_SSH'
    1298063168.409852/1298063168.410945 [logging] Wrote record to filter 'default' on stream 'SSH::LOG_SSH'
    1298063168.409852/1298063168.411044 [logging] Wrote record to filter 'default' on stream 'SSH::LOG_SSH

> cat ssh_log_ssh.log
1298063168.40985        1.2.3.4 66770   2.3.4.5 65616   success unknown
1298063168.40985        1.2.3.4 66770   2.3.4.5 65616   failure US
1298063168.40985        1.2.3.4 66770   2.3.4.5 65616   failure UK
1298063168.40985        1.2.3.4 66770   2.3.4.5 65616   success BR
1298063168.40985        1.2.3.4 66770   2.3.4.5 65616   failure MX
This commit is contained in:
Robin Sommer 2011-02-18 13:03:46 -08:00
parent 9d407d882c
commit 68062e87f1
18 changed files with 1121 additions and 218 deletions
Download patch file Download diff file Expand all files Collapse all files

82
src/LogWriter.h Normal file
View file

@ -0,0 +1,82 @@
//
// Interface API for a log writer backend.
//
// Note than classes derived from LogWriter must be fully thread-safe and not
// use any non-safe Bro functionality (which is almost all ...). In
// particular, do not use fmt() but LogWriter::Fmt()!.
#ifndef LOGWRITER_H
#define LOGWRITER_H
#include "LogMgr.h"
#include "BroString.h"
class LogWriter {
public:
LogWriter();
virtual ~LogWriter();
// One-time initialization of the writer, defining the logged fields.
// Interpretation of "path" is left to the writer, and will be the value
// configured on the script-level. Returns false if an error occured, in
// which case the writer must not be used futher.
//
// The new instance takes ownership of "fields", and will delete them
// when done.
bool Init(string path, int num_fields, LogField** fields);
// Writes one log entry. The method takes ownership of "vals" and will
// return immediately after queueing the write request, potentially
// before the output has actually taken place. Returns false if an error
// occured, in which case the writer must not be used further.
bool Write(LogVal** vals);
// Finished writing to this logger. Will not be called if an error has
// been indicated earlier. After calling this, no more writing must be
// performed.
void Finish();
protected:
//// Methods for Writers to override.
// Called once for initialization of the Writer. Must return false if an
// error occured, in which case the writer will be disabled. The error
// reason should be reported via Error().
virtual bool DoInit(string path, int num_fields, LogField** fields) = 0;
// Called once per entry to record. Must return false if an error
// occured, in which case the writer will be disabled. The error reason
// should be reported via Error().
virtual bool DoWrite(int num_fields, LogField** fields, LogVal** vals) = 0;
// Called once on termination. Not called when any of the other methods
// has previously signaled an error, i.e., executing this method signals
// a regular shutdown.
virtual void DoFinish() = 0;
//// Methods for Writers to use. These are thread-safe.
// A thread-safe version of fmt().
const char* Fmt(const char* format, ...);
// Reports an error.
void Error(const char *msg);
// Returns the path as passed to Init().
const string Path() const { return path; }
private:
// Delete values as passed into Write().
void DeleteVals(LogVal** vals);
string path;
int num_fields;
LogField** fields;
// For Fmt().
char* buf;
unsigned int buf_len;
};
#endif