Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

broker/Publish: Use event time instead of network time

Browse source 
Discussed with @J-Gras, calling Broker::publish() within a scheduled
should use the "intended timestamp" implicitly.

This is subtle, but supposedly more expected when running
a pcap replay cluster.
This commit is contained in:
Arne Welzel 2024-11-12 13:26:38 +01:00
parent 6abb9d7eda
commit 831614f907
6 changed files with 163 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
NEWS
View file

@ -103,6 +103,11 @@ Changed Functionality
of a node are scraped via the Prometheus HTTP endpoint, or one of the collect
methods is invoked from Zeek script.
* Calling ``Broker::publish()`` now uses the event time of the currently
executing event as network time metadata attached to the remote event.
Previously, ``network_time()`` was used. This matters if ``Broker::publish()``
is called within scheduled events or called within remote events.
Removed Functionality
---------------------