mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
postgresql: Initial parser implementation
This adds a protocol parser for the PostgreSQL protocol and a new postgresql.log similar to the existing mysql.log. This should be considered preliminary and hopefully during 7.1 and 7.2 with feedback from the community, we can improve on the events and logs. Even if most PostgreSQL communication is encrypted in the real-world, this will minimally allow monitoring of the SSLRequest and hand off further analysis to the SSL analyzer. This originates from github.com/awelzel/spicy-postgresql, with lots of polishing happening in the past two days.
This commit is contained in:
parent
2907d9feee
commit
85ca59484b
82 changed files with 1803 additions and 10 deletions
16
NEWS
16
NEWS
|
@ -28,6 +28,22 @@ Breaking Changes
|
|||
New Functionality
|
||||
-----------------
|
||||
|
||||
- Zeek now includes a PostgreSQL protocol analyzer. This analyzer is enabled
|
||||
by default. The analyzer's events and its ``postgresql.log`` should be
|
||||
considered preliminary and experimental until the arrival of Zeek's next
|
||||
long-term-stable release (8.0).
|
||||
|
||||
If you observe unusually high CPU consumption or other issues due to this
|
||||
analyzer being enabled by default, the easiest way to disable it is via the
|
||||
``Analyzer::disabled_analyzers`` const as follows:
|
||||
|
||||
redef Analyzer::disabled_analyzers += {
|
||||
Analyzer::ANALYZER_POSTGRESQL,
|
||||
};
|
||||
|
||||
If you observe PostgreSQL traffic in your environment, please provide feedback
|
||||
about the analyzer and structure of the new log.
|
||||
|
||||
* The LDAP analyzer now supports handling of non-sealed GSS-API WRAP tokens.
|
||||
|
||||
* StartTLS support was added to the LDAP analyzer. The SSL analyzer is enabled
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue