Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Management framework: expand notify_agent_hello event arguments

Browse source 
This swaps the host event argument for the Broker ID. The latter is more useful,
since the sending agent doesn't necessarily know its IP address as visible to
the controller, and the controller can pull up the full Broker context via the
ID.

It also adds an explicit argument to the event to indicate whether the agent
connected to the controller or vice versa. This simplifies the controller's
internal logic.

Also minor tweaks to logging to show Broker IDs.
This commit is contained in:
Christian Kreibich 2022-06-02 18:11:56 -07:00
parent aa689807fa
commit 72acf24f52
5 changed files with 18 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/policy/frameworks/management/controller/main.zeek
View file

@ -273,9 +273,10 @@ event Management::Controller::API::notify_agents_ready(instances: set[string])
send_config_to_agents(req, req$set_configuration_state$config);
}
event Management::Agent::API::notify_agent_hello(instance: string, host: addr, api_version: count)
event Management::Agent::API::notify_agent_hello(instance: string, id: string, connecting: bool, api_version: count)
{
Management::Log::info(fmt("rx Management::Agent::API::notify_agent_hello %s %s", instance, host));
Management::Log::info(fmt("rx Management::Agent::API::notify_agent_hello %s %s %s",
instance, id, connecting));
# When an agent checks in with a mismatching API version, we log the
# fact and drop its state, if any.
@ -283,7 +284,7 @@ event Management::Agent::API::notify_agent_hello(instance: string, host: addr, a
{
Management::Log::warning(
fmt("instance %s/%s has checked in with incompatible API version %s",
instance, host, api_version));
instance, id, api_version));
if ( instance in g_instances )
drop_instance(g_instances[instance]);
@ -882,5 +883,5 @@ event zeek_init()
Broker::subscribe(Management::Agent::topic_prefix);
Broker::subscribe(Management::Controller::topic);
Management::Log::info("controller is live");
Management::Log::info(fmt("controller is live, Broker ID %s", Broker::node_id()));
}