diff --git a/scripts/policy/frameworks/management/agent/api.zeek b/scripts/policy/frameworks/management/agent/api.zeek index 9fddaa44f1..ba9c0b22bd 100644 --- a/scripts/policy/frameworks/management/agent/api.zeek +++ b/scripts/policy/frameworks/management/agent/api.zeek @@ -145,17 +145,20 @@ export { ## The agent sends this event upon peering as a "check-in", informing ## the controller that an agent of the given name is now available to ## communicate with. It is a controller-level equivalent of - ## `:zeek:see:`Broker::peer_added`. + ## `:zeek:see:`Broker::peer_added` and triggered by it. ## ## instance: an instance name, really the agent's name as per ## :zeek:see:`Management::Agent::get_name`. ## - ## host: the IP address of the agent. (This may change in the future.) + ## id: the Broker ID of the agent. + ## + ## connecting: true if this agent connected to the controller, + ## false if the controller connected to the agent. ## ## api_version: the API version of this agent. ## - global notify_agent_hello: event(instance: string, host: addr, - api_version: count); + global notify_agent_hello: event(instance: string, id: string, + connecting: bool, api_version: count); # The following are not yet implemented. diff --git a/scripts/policy/frameworks/management/agent/main.zeek b/scripts/policy/frameworks/management/agent/main.zeek index 5b9912c89b..6105edb8dd 100644 --- a/scripts/policy/frameworks/management/agent/main.zeek +++ b/scripts/policy/frameworks/management/agent/main.zeek @@ -694,7 +694,8 @@ event Broker::peer_added(peer: Broker::EndpointInfo, msg: string) Broker::publish(agent_topic(), Management::Agent::API::notify_agent_hello, - epi$id, to_addr(epi$network$address), + epi$id, Broker::node_id(), + Management::Agent::controller$address != "0.0.0.0", Management::Agent::API::version); } @@ -736,5 +737,5 @@ event zeek_init() # If the controller connects to us, it also uses this port. Broker::listen(cat(epi$network$address), epi$network$bound_port); - Management::Log::info("agent is live"); + Management::Log::info(fmt("agent is live, Broker ID %s", Broker::node_id())); } diff --git a/scripts/policy/frameworks/management/controller/main.zeek b/scripts/policy/frameworks/management/controller/main.zeek index 4759f5774c..ccee0a6a7d 100644 --- a/scripts/policy/frameworks/management/controller/main.zeek +++ b/scripts/policy/frameworks/management/controller/main.zeek @@ -273,9 +273,10 @@ event Management::Controller::API::notify_agents_ready(instances: set[string]) send_config_to_agents(req, req$set_configuration_state$config); } -event Management::Agent::API::notify_agent_hello(instance: string, host: addr, api_version: count) +event Management::Agent::API::notify_agent_hello(instance: string, id: string, connecting: bool, api_version: count) { - Management::Log::info(fmt("rx Management::Agent::API::notify_agent_hello %s %s", instance, host)); + Management::Log::info(fmt("rx Management::Agent::API::notify_agent_hello %s %s %s", + instance, id, connecting)); # When an agent checks in with a mismatching API version, we log the # fact and drop its state, if any. @@ -283,7 +284,7 @@ event Management::Agent::API::notify_agent_hello(instance: string, host: addr, a { Management::Log::warning( fmt("instance %s/%s has checked in with incompatible API version %s", - instance, host, api_version)); + instance, id, api_version)); if ( instance in g_instances ) drop_instance(g_instances[instance]); @@ -882,5 +883,5 @@ event zeek_init() Broker::subscribe(Management::Agent::topic_prefix); Broker::subscribe(Management::Controller::topic); - Management::Log::info("controller is live"); + Management::Log::info(fmt("controller is live, Broker ID %s", Broker::node_id())); } diff --git a/testing/btest/Baseline/scripts.policy.frameworks.management.controller.agent-checkin/zeek.nodes.controller.stdout b/testing/btest/Baseline/scripts.policy.frameworks.management.controller.agent-checkin/zeek.nodes.controller.stdout index 3ce8a1f373..2aa07185c6 100644 --- a/testing/btest/Baseline/scripts.policy.frameworks.management.controller.agent-checkin/zeek.nodes.controller.stdout +++ b/testing/btest/Baseline/scripts.policy.frameworks.management.controller.agent-checkin/zeek.nodes.controller.stdout @@ -1,2 +1,2 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -notify_agent_hello agent 127.0.0.1 1 +notify_agent_hello agent 1 diff --git a/testing/btest/scripts/policy/frameworks/management/controller/agent-checkin.zeek b/testing/btest/scripts/policy/frameworks/management/controller/agent-checkin.zeek index 3d248848c7..be0881c6ad 100644 --- a/testing/btest/scripts/policy/frameworks/management/controller/agent-checkin.zeek +++ b/testing/btest/scripts/policy/frameworks/management/controller/agent-checkin.zeek @@ -40,14 +40,12 @@ event zeek_init() } } -event Management::Agent::API::notify_agent_hello(instance: string, host: addr, api_version: count) +event Management::Agent::API::notify_agent_hello(instance: string, id: string, connecting: bool, api_version: count) { if ( Management::role == Management::CONTROLLER ) { - # On rare occasion it can happen that we log this twice, which'll need - # investigating. For now we ensure we only do so once. if ( ! logged ) - print(fmt("notify_agent_hello %s %s %s", instance, host, api_version)); + print(fmt("notify_agent_hello %s %s", instance, api_version)); logged = T;