Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Plugin: Add hooks for log init and writing.

Browse source 
The two hooks being added are:

void HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local, bool remote, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields);

which is called when a writer is being instantiated and contains
information about the fields being logged, as well as

bool HookLogWrite(const std::string& writer, const std::string& filter, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields, threading::Value** vals);

which is called for each log line being written by each writer. It
contains all the data being written. The data can be changed in the
function call and lines can be prevented from being written.

This commit also fixes a few small problems with plugin hooks itself,
and extends the tests that were already there, besides introducing tests
for the added functionality.
This commit is contained in:
Johanna Amann 2017-02-27 10:01:14 -08:00
parent 2c2c9c9052
commit 684ea8aa37
16 changed files with 689 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/logging/Manager.cc
View file

@ -15,6 +15,8 @@
#include "WriterFrontend.h"
#include "WriterBackend.h"
#include "logging.bif.h"
#include "../plugin/Plugin.h"
#include "../plugin/Manager.h"
#ifdef ENABLE_BROKER
#include "broker/Manager.h"
@ -62,6 +64,7 @@ struct Manager::WriterInfo {
WriterFrontend* writer;
WriterBackend::WriterInfo* info;
bool from_remote;
bool hook_initialized;
string instantiating_filter;
};
@ -840,12 +843,21 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
path = filter->path = filter->path_val->AsString()->CheckString();
}
WriterBackend::WriterInfo* info = 0;
WriterFrontend* writer = 0;
if ( w != stream->writers.end() )
{
// We know this writer already.
writer = w->second->writer;
info = w->second->info;
if ( ! w->second->hook_initialized )
{
auto wi = w->second;
wi->hook_initialized = true;
PLUGIN_HOOK_VOID(HOOK_LOG_INIT, HookLogInit(filter->writer->Type()->AsEnumType()->Lookup(filter->writer->InternalInt()), wi->instantiating_filter, filter->local, filter->remote, *wi->info, filter->num_fields, filter->fields));
}
}
else
@ -874,7 +886,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
arg_fields[j] = new threading::Field(*filter->fields[j]);
}
WriterBackend::WriterInfo* info = new WriterBackend::WriterInfo;
info = new WriterBackend::WriterInfo;
info->path = copy_string(path.c_str());
info->network_time = network_time;
@ -909,6 +921,16 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
threading::Value** vals = RecordToFilterVals(stream, filter, columns);
if ( ! PLUGIN_HOOK_WITH_RESULT(HOOK_LOG_WRITE, HookLogWrite(filter->writer->Type()->AsEnumType()->Lookup(filter->writer->InternalInt()), filter->name, *info, filter->num_fields, filter->fields, vals), true) )
{
DeleteVals(filter->num_fields, vals);
#ifdef DEBUG
DBG_LOG(DBG_LOGGING, "Hook prevented writing to filter '%s' on stream '%s'",
filter->name.c_str(), stream->name.c_str());
#endif
return true;
}
// Write takes ownership of vals.
assert(writer);
writer->Write(filter->num_fields, vals);
@ -1165,6 +1187,7 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken
winfo->postprocessor = 0;
winfo->info = info;
winfo->from_remote = from_remote;
winfo->hook_initialized = false;
winfo->instantiating_filter = instantiating_filter;
// Search for a corresponding filter for the writer/path pair and use its
@ -1214,6 +1237,11 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken
#endif
winfo->writer->Init(num_fields, fields);
if ( ! from_remote )
{
winfo->hook_initialized = true;
PLUGIN_HOOK_VOID(HOOK_LOG_INIT, HookLogInit(writer->Type()->AsEnumType()->Lookup(writer->InternalInt()), instantiating_filter, local, remote, *winfo->info, num_fields, fields));
}
InstallRotationTimer(winfo);
return winfo->writer;