Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Working on DataSeries support.

Browse source 
- The option to use integers insteads of double was ignored.

   - Renaming script-level options to remove the ds_ prefix.

   - Log rotation didn't work.

   - A set of simple unit tests.
This commit is contained in:
Robin Sommer 2012-04-09 17:30:57 -07:00
parent 952b6b293a
commit 7131feefbc
16 changed files with 1001 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

43
testing/btest/Baseline/scripts.base.frameworks.logging.dataseries.test-logging/ssh.ds.txt Normal file
View file

@ -0,0 +1,43 @@
# Extent Types ...
<ExtentType name="DataSeries: ExtentIndex">
<field type="int64" name="offset" />
<field type="variable32" name="extenttype" />
</ExtentType>
<ExtentType name="DataSeries: XmlType">
<field type="variable32" name="xmltype" />
</ExtentType>
<ExtentType name="ssh" version="1.0" namespace="bro-ids.org">
<field type="double" name="t" pack_relative="t" pack_scale="1000000"/>
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
<field type="int64" name="id.orig_p" />
<field type="variable32" name="id.resp_h" pack_unique="yes"/>
<field type="int64" name="id.resp_p" />
<field type="variable32" name="status" pack_unique="yes"/>
<field type="variable32" name="country" pack_unique="yes"/>
</ExtentType>
<!-- t : time -->
<!-- id.orig_h : addr -->
<!-- id.orig_p : port -->
<!-- id.resp_h : addr -->
<!-- id.resp_p : port -->
<!-- status : string -->
<!-- country : string -->
extent offset ExtentType
40 DataSeries: XmlType
400 ssh
604 DataSeries: ExtentIndex
# Extent, type='ssh'
t id.orig_h id.orig_p id.resp_h id.resp_p status country
1.334e+09 1.2.3.4 1234 2.3.4.5 80 success unknown
1.334e+09 1.2.3.4 1234 2.3.4.5 80 failure US
1.334e+09 1.2.3.4 1234 2.3.4.5 80 failure UK
1.334e+09 1.2.3.4 1234 2.3.4.5 80 success BR
1.334e+09 1.2.3.4 1234 2.3.4.5 80 failure MX
# Extent, type='DataSeries: ExtentIndex'
offset extenttype
40 DataSeries: XmlType
400 ssh
604 DataSeries: ExtentIndex