cluster/logger: Fix leftover-log-rotation in multi-logger setups

Populating log_metadata during zeek_init() is too late for the
leftover-log-rotation functionality, so do it at script parse time.

Also, prepend archiver_ to the log_metadata table and encoding function
due to being in the global namespace and to align with the
archiver_rotation_format_func. This hasn't been in a released
version yet, so fine to rename still.

Closes #3112
This commit is contained in:
Arne Welzel 2023-06-13 10:36:40 +02:00
parent 27432c457c
commit 6d1991fb6a
3 changed files with 64 additions and 16 deletions

View file

@ -0,0 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
./log-queue/conn__XXXX-XX-XX-XX-XX-XX__XXXX-XX-XX-XX-XX-XX__log_suffix=logger-2__.log
./log-queue/dns__XXXX-XX-XX-XX-XX-XX__XXXX-XX-XX-XX-XX-XX__log_suffix=logger-2__.log
leftover conn log
leftover dns log

View file

@ -0,0 +1,44 @@
# @TEST-DOC: Ensure that left-over log rotation tags the logger name on as well.
# @TEST-EXEC: echo ".log" >> .shadow.conn.log
# @TEST-EXEC: echo "archiver_rotation_format_func" >> .shadow.conn.log
# @TEST-EXEC: echo "leftover conn log" > conn.log
# @TEST-EXEC: echo ".log" >> .shadow.dns.log
# @TEST-EXEC: echo "archiver_rotation_format_func" >> .shadow.dns.log
# @TEST-EXEC: echo "leftover dns log" > dns.log
# Start Zeek as cluster node logger-2.
# @TEST-EXEC: CLUSTER_NODE=logger-2 zeek -b %INPUT > out
# Ensure leftover files were removed.
# @TEST-EXEC: ! test -f .shadow.conn.log
# @TEST-EXEC: ! test -f conn.log
# @TEST-EXEC: ! test -f .shadow.dns.log
# @TEST-EXEC: ! test -f dns.log
# Ensure the rotated files end-up in the default log-queue directory and have
# the logger-2 name encoded into them.
# @TEST-EXEC: ls ./log-queue/conn__*.log >>out
# @TEST-EXEC: ls ./log-queue/dns__*.log >>out
# @TEST-EXEC: cat ./log-queue/conn__*logger-2__.log ./log-queue/dns__*logger-2__.log >>out
# @TEST-EXEC: TEST_DIFF_CANONIFIER='sed -r "s/[0-9]{2}/XX/g"' btest-diff out
@TEST-START-FILE cluster-layout.zeek
redef Cluster::nodes = {
["logger-1"] = [$node_type=Cluster::LOGGER, $ip=127.0.0.1, $p=1234/tcp],
["logger-2"] = [$node_type=Cluster::LOGGER, $ip=127.0.0.1, $p=1235/tcp],
};
@TEST-END-FILE
# Switch settings into a supervisor/non-zeekctl setup
redef Log::default_rotation_dir = "log-queue";
redef Log::rotation_format_func = archiver_rotation_format_func;
redef LogAscii::enable_leftover_log_rotation = T;
redef Log::default_rotation_postprocessor_cmd = "";
event zeek_init()
{
terminate();
}