mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
Minor clarifications and typo fixes in broker doc
This commit is contained in:
parent
92c5885f06
commit
7ce0cefcba
2 changed files with 37 additions and 39 deletions
|
@ -9,10 +9,7 @@ Broker-Enabled Communication Framework
|
||||||
|
|
||||||
Bro can now use the `Broker Library
|
Bro can now use the `Broker Library
|
||||||
<../components/broker/README.html>`_ to exchange information with
|
<../components/broker/README.html>`_ to exchange information with
|
||||||
other Bro processes. To enable it run Bro's ``configure`` script
|
other Bro processes.
|
||||||
with the ``--enable-broker`` option. Note that a C++11 compatible
|
|
||||||
compiler (e.g. GCC 4.8+ or Clang 3.3+) is required as well as the
|
|
||||||
`C++ Actor Framework <http://actor-framework.org/>`_.
|
|
||||||
|
|
||||||
.. contents::
|
.. contents::
|
||||||
|
|
||||||
|
@ -23,26 +20,26 @@ Communication via Broker must first be turned on via
|
||||||
:bro:see:`BrokerComm::enable`.
|
:bro:see:`BrokerComm::enable`.
|
||||||
|
|
||||||
Bro can accept incoming connections by calling :bro:see:`BrokerComm::listen`
|
Bro can accept incoming connections by calling :bro:see:`BrokerComm::listen`
|
||||||
and then monitor connection status updates via
|
and then monitor connection status updates via the
|
||||||
:bro:see:`BrokerComm::incoming_connection_established` and
|
:bro:see:`BrokerComm::incoming_connection_established` and
|
||||||
:bro:see:`BrokerComm::incoming_connection_broken`.
|
:bro:see:`BrokerComm::incoming_connection_broken` events.
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/connecting-listener.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/connecting-listener.bro
|
||||||
|
|
||||||
Bro can initiate outgoing connections by calling :bro:see:`BrokerComm::connect`
|
Bro can initiate outgoing connections by calling :bro:see:`BrokerComm::connect`
|
||||||
and then monitor connection status updates via
|
and then monitor connection status updates via the
|
||||||
:bro:see:`BrokerComm::outgoing_connection_established`,
|
:bro:see:`BrokerComm::outgoing_connection_established`,
|
||||||
:bro:see:`BrokerComm::outgoing_connection_broken`, and
|
:bro:see:`BrokerComm::outgoing_connection_broken`, and
|
||||||
:bro:see:`BrokerComm::outgoing_connection_incompatible`.
|
:bro:see:`BrokerComm::outgoing_connection_incompatible` events.
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/connecting-connector.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/connecting-connector.bro
|
||||||
|
|
||||||
Remote Printing
|
Remote Printing
|
||||||
===============
|
===============
|
||||||
|
|
||||||
To receive remote print messages, first use
|
To receive remote print messages, first use the
|
||||||
:bro:see:`BrokerComm::subscribe_to_prints` to advertise to peers a topic
|
:bro:see:`BrokerComm::subscribe_to_prints` function to advertise to peers a
|
||||||
prefix of interest and then create an event handler for
|
topic prefix of interest and then create an event handler for
|
||||||
:bro:see:`BrokerComm::print_handler` to handle any print messages that are
|
:bro:see:`BrokerComm::print_handler` to handle any print messages that are
|
||||||
received.
|
received.
|
||||||
|
|
||||||
|
@ -71,17 +68,17 @@ the Broker message format is simply:
|
||||||
Remote Events
|
Remote Events
|
||||||
=============
|
=============
|
||||||
|
|
||||||
Receiving remote events is similar to remote prints. Just use
|
Receiving remote events is similar to remote prints. Just use the
|
||||||
:bro:see:`BrokerComm::subscribe_to_events` and possibly define any new events
|
:bro:see:`BrokerComm::subscribe_to_events` function and possibly define any
|
||||||
along with handlers that peers may want to send.
|
new events along with handlers that peers may want to send.
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/events-listener.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/events-listener.bro
|
||||||
|
|
||||||
To send events, there are two choices. The first is to use call
|
There are two different ways to send events. The first is to call the
|
||||||
:bro:see:`BrokerComm::event` directly. The second option is to use
|
:bro:see:`BrokerComm::event` function directly. The second option is to call
|
||||||
:bro:see:`BrokerComm::auto_event` to make it so a particular event is
|
the :bro:see:`BrokerComm::auto_event` function where you specify a
|
||||||
automatically sent to peers whenever it is called locally via the normal
|
particular event that will be automatically sent to peers whenever the
|
||||||
event invocation syntax.
|
event is called locally via the normal event invocation syntax.
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/events-connector.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/events-connector.bro
|
||||||
|
|
||||||
|
@ -98,7 +95,7 @@ the Broker message format is:
|
||||||
broker::message{std::string{}, ...};
|
broker::message{std::string{}, ...};
|
||||||
|
|
||||||
The first parameter is the name of the event and the remaining ``...``
|
The first parameter is the name of the event and the remaining ``...``
|
||||||
are its arguments, which are any of the support Broker data types as
|
are its arguments, which are any of the supported Broker data types as
|
||||||
they correspond to the Bro types for the event named in the first
|
they correspond to the Bro types for the event named in the first
|
||||||
parameter of the message.
|
parameter of the message.
|
||||||
|
|
||||||
|
@ -107,23 +104,23 @@ Remote Logging
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/testlog.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/testlog.bro
|
||||||
|
|
||||||
Use :bro:see:`BrokerComm::subscribe_to_logs` to advertise interest in logs
|
Use the :bro:see:`BrokerComm::subscribe_to_logs` function to advertise interest
|
||||||
written by peers. The topic names that Bro uses are implicitly of the
|
in logs written by peers. The topic names that Bro uses are implicitly of the
|
||||||
form "bro/log/<stream-name>".
|
form "bro/log/<stream-name>".
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/logs-listener.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/logs-listener.bro
|
||||||
|
|
||||||
To send remote logs either use :bro:see:`Log::enable_remote_logging` or
|
To send remote logs either redef :bro:see:`Log::enable_remote_logging` or
|
||||||
:bro:see:`BrokerComm::enable_remote_logs`. The former allows any log stream
|
use the :bro:see:`BrokerComm::enable_remote_logs` function. The former
|
||||||
to be sent to peers while the later toggles remote logging for
|
allows any log stream to be sent to peers while the latter enables remote
|
||||||
particular streams.
|
logging for particular streams.
|
||||||
|
|
||||||
.. btest-include:: ${DOC_ROOT}/frameworks/broker/logs-connector.bro
|
.. btest-include:: ${DOC_ROOT}/frameworks/broker/logs-connector.bro
|
||||||
|
|
||||||
Message Format
|
Message Format
|
||||||
--------------
|
--------------
|
||||||
|
|
||||||
For other applications that want to exchange logs messages with Bro,
|
For other applications that want to exchange log messages with Bro,
|
||||||
the Broker message format is:
|
the Broker message format is:
|
||||||
|
|
||||||
.. code:: c++
|
.. code:: c++
|
||||||
|
@ -132,7 +129,7 @@ the Broker message format is:
|
||||||
|
|
||||||
The enum value corresponds to the stream's :bro:see:`Log::ID` value, and
|
The enum value corresponds to the stream's :bro:see:`Log::ID` value, and
|
||||||
the record corresponds to a single entry of that log's columns record,
|
the record corresponds to a single entry of that log's columns record,
|
||||||
in this case a ``Test::INFO`` value.
|
in this case a ``Test::Info`` value.
|
||||||
|
|
||||||
Tuning Access Control
|
Tuning Access Control
|
||||||
=====================
|
=====================
|
||||||
|
@ -152,10 +149,11 @@ that take a :bro:see:`BrokerComm::SendFlags` such as :bro:see:`BrokerComm::print
|
||||||
:bro:see:`BrokerComm::enable_remote_logs`.
|
:bro:see:`BrokerComm::enable_remote_logs`.
|
||||||
|
|
||||||
If not using the ``auto_advertise`` flag, one can use the
|
If not using the ``auto_advertise`` flag, one can use the
|
||||||
:bro:see:`BrokerComm::advertise_topic` and :bro:see:`BrokerComm::unadvertise_topic`
|
:bro:see:`BrokerComm::advertise_topic` and
|
||||||
to manupulate the set of topic prefixes that are allowed to be
|
:bro:see:`BrokerComm::unadvertise_topic` functions
|
||||||
advertised to peers. If an endpoint does not advertise a topic prefix,
|
to manipulate the set of topic prefixes that are allowed to be
|
||||||
the only way a peers can send messages to it is via the ``unsolicited``
|
advertised to peers. If an endpoint does not advertise a topic prefix, then
|
||||||
|
the only way peers can send messages to it is via the ``unsolicited``
|
||||||
flag of :bro:see:`BrokerComm::SendFlags` and choosing a topic with a matching
|
flag of :bro:see:`BrokerComm::SendFlags` and choosing a topic with a matching
|
||||||
prefix (i.e. full topic may be longer than receivers prefix, just the
|
prefix (i.e. full topic may be longer than receivers prefix, just the
|
||||||
prefix needs to match).
|
prefix needs to match).
|
||||||
|
@ -172,7 +170,7 @@ specific type of frontend, but a standalone frontend can also exist to
|
||||||
e.g. query and modify the contents of a remote master store without
|
e.g. query and modify the contents of a remote master store without
|
||||||
actually "owning" any of the contents itself.
|
actually "owning" any of the contents itself.
|
||||||
|
|
||||||
A master data store can be be cloned from remote peers which may then
|
A master data store can be cloned from remote peers which may then
|
||||||
perform lightweight, local queries against the clone, which
|
perform lightweight, local queries against the clone, which
|
||||||
automatically stays synchronized with the master store. Clones cannot
|
automatically stays synchronized with the master store. Clones cannot
|
||||||
modify their content directly, instead they send modifications to the
|
modify their content directly, instead they send modifications to the
|
||||||
|
@ -181,7 +179,7 @@ all clones.
|
||||||
|
|
||||||
Master and clone stores get to choose what type of storage backend to
|
Master and clone stores get to choose what type of storage backend to
|
||||||
use. E.g. In-memory versus SQLite for persistence. Note that if clones
|
use. E.g. In-memory versus SQLite for persistence. Note that if clones
|
||||||
are used, data store sizes should still be able to fit within memory
|
are used, then data store sizes must be able to fit within memory
|
||||||
regardless of the storage backend as a single snapshot of the master
|
regardless of the storage backend as a single snapshot of the master
|
||||||
store is sent in a single chunk to initialize the clone.
|
store is sent in a single chunk to initialize the clone.
|
||||||
|
|
||||||
|
@ -198,5 +196,5 @@ needed, just replace the :bro:see:`BrokerStore::create_clone` call with
|
||||||
:bro:see:`BrokerStore::create_frontend`. Queries will then be made against
|
:bro:see:`BrokerStore::create_frontend`. Queries will then be made against
|
||||||
the remote master store instead of the local clone.
|
the remote master store instead of the local clone.
|
||||||
|
|
||||||
Note that all queries are made within Bro's asynchrounous ``when``
|
Note that all data store queries must be made within Bro's asynchronous
|
||||||
statements and must specify a timeout block.
|
``when`` statements and must specify a timeout block.
|
||||||
|
|
|
@ -32,13 +32,13 @@ before you begin:
|
||||||
* Libz
|
* Libz
|
||||||
* Bash (for BroControl)
|
* Bash (for BroControl)
|
||||||
* Python (for BroControl)
|
* Python (for BroControl)
|
||||||
* C++ Actor Framework (CAF) (http://actor-framework.org)
|
* C++ Actor Framework (CAF) version 0.14 (http://actor-framework.org)
|
||||||
|
|
||||||
To build Bro from source, the following additional dependencies are required:
|
To build Bro from source, the following additional dependencies are required:
|
||||||
|
|
||||||
* CMake 2.8 or greater (http://www.cmake.org)
|
* CMake 2.8 or greater (http://www.cmake.org)
|
||||||
* Make
|
* Make
|
||||||
* C/C++ compiler with C++11 support
|
* C/C++ compiler with C++11 support (GCC 4.8+ or Clang 3.3+)
|
||||||
* SWIG (http://www.swig.org)
|
* SWIG (http://www.swig.org)
|
||||||
* Bison (GNU Parser Generator)
|
* Bison (GNU Parser Generator)
|
||||||
* Flex (Fast Lexical Analyzer)
|
* Flex (Fast Lexical Analyzer)
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue