mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
Merge remote-tracking branch 'origin/fastpath' into topic/bernhard/reader-info
Conflicts: src/logging/WriterBackend.cc src/logging/WriterBackend.h src/logging/WriterFrontend.cc testing/btest/Baseline/scripts.base.frameworks.input.event/out testing/btest/Baseline/scripts.base.frameworks.input.executeraw/out testing/btest/Baseline/scripts.base.frameworks.input.raw/out testing/btest/Baseline/scripts.base.frameworks.input.rereadraw/out testing/btest/Baseline/scripts.base.frameworks.input.tableevent/out
This commit is contained in:
Bernhard Amann
commit
86826770ab
49 changed files with 1159 additions and 710 deletions
|
|
@ -5,7 +5,7 @@
|
|||
# @TEST-EXEC: btest-bg-wait -k 10
|
||||
#
|
||||
# Don't diff the receiver log just because port is always going to change
|
||||
# @TEST-EXEC: egrep -v 'pid|socket buffer size' sender/communication.log >send.log
|
||||
# @TEST-EXEC: egrep -v 'CPU|bytes|pid|socket buffer size' sender/communication.log >send.log
|
||||
# @TEST-EXEC: btest-diff send.log
|
||||
|
||||
@TEST-START-FILE sender.bro
|
||||
|
|
@ -19,6 +19,10 @@ redef Communication::nodes += {
|
|||
event remote_connection_handshake_done(p: event_peer)
|
||||
{
|
||||
terminate_communication();
|
||||
}
|
||||
|
||||
event remote_connection_closed(p: event_peer)
|
||||
{
|
||||
terminate();
|
||||
}
|
||||
|
||||
|
|
@ -30,9 +34,8 @@ event remote_connection_handshake_done(p: event_peer)
|
|||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
event remote_connection_handshake_done(p: event_peer)
|
||||
event remote_connection_closed(p: event_peer)
|
||||
{
|
||||
terminate_communication();
|
||||
terminate();
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -22,4 +22,5 @@ redef test_var = "This is the value from the controllee";
|
|||
event Control::id_value_response(id: string, val: string)
|
||||
{
|
||||
print fmt("Got an id_value_response(%s, %s) event", id, val);
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -10,6 +13,11 @@
|
|||
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/protocols/ssh
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -39,12 +47,16 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("ssh");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source:string) {
|
||||
print servers;
|
||||
}
|
||||
event Input::update_finished(name: string, source:string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -11,6 +14,10 @@ T 1
|
|||
- 2
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -26,12 +33,16 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("ssh");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source:string) {
|
||||
print servers;
|
||||
}
|
||||
event Input::update_finished(name: string, source:string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -16,6 +19,10 @@
|
|||
7 T
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
module A;
|
||||
|
||||
|
|
@ -24,15 +31,24 @@ type Val: record {
|
|||
b: bool;
|
||||
};
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, i: int, b: bool) {
|
||||
print description;
|
||||
print tpe;
|
||||
print i;
|
||||
print b;
|
||||
}
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, i: int, b: bool)
|
||||
{
|
||||
print outfile, description;
|
||||
print outfile, tpe;
|
||||
print outfile, i;
|
||||
print outfile, b;
|
||||
try = try + 1;
|
||||
if ( try == 7 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_event([$source="input.log", $name="input", $fields=Val, $ev=line]);
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
Input::add_event([$source="../input.log", $name="input", $fields=Val, $ev=line]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 1
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: cat out.tmp | sed 's/^ *//g' >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
|
|
@ -23,16 +25,18 @@ type Val: record {
|
|||
s: string;
|
||||
};
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string) {
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string)
|
||||
{
|
||||
print outfile, description;
|
||||
print outfile, tpe;
|
||||
print outfile, s;
|
||||
close(outfile);
|
||||
}
|
||||
terminate();
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open ("../out.tmp");
|
||||
{
|
||||
outfile = open("../out.tmp");
|
||||
Input::add_event([$source="wc -l ../input.log |", $reader=Input::READER_RAW, $name="input", $fields=Val, $ev=line]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -10,6 +13,10 @@
|
|||
T -42
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -25,12 +32,16 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F]);
|
||||
{
|
||||
outfile = open("../out");
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print servers;
|
||||
}
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -10,6 +13,10 @@
|
|||
T -42
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -25,12 +32,16 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_table([$name="input", $source="input.log", $idx=Idx, $val=Val, $destination=servers]);
|
||||
{
|
||||
outfile = open("../out");
|
||||
Input::add_table([$name="input", $source="../input.log", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print servers;
|
||||
}
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -16,6 +19,10 @@
|
|||
7 T
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -32,14 +39,18 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=servers,
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = { right$notb = !right$b; return T; }
|
||||
]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print servers;
|
||||
}
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -9,6 +12,10 @@
|
|||
1.2.3.6 30 unknown
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -24,17 +31,23 @@ type Val: record {
|
|||
global servers: table[addr] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=servers]);
|
||||
print servers[1.2.3.4];
|
||||
print servers[1.2.3.5];
|
||||
print servers[1.2.3.6];
|
||||
{
|
||||
outfile = open("../out");
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers]);
|
||||
if ( 1.2.3.4 in servers )
|
||||
print outfile, servers[1.2.3.4];
|
||||
if ( 1.2.3.5 in servers )
|
||||
print outfile, servers[1.2.3.5];
|
||||
if ( 1.2.3.6 in servers )
|
||||
print outfile, servers[1.2.3.6];
|
||||
Input::remove("input");
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print servers[1.2.3.4];
|
||||
print servers[1.2.3.5];
|
||||
print servers[1.2.3.6];
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, servers[1.2.3.4];
|
||||
print outfile, servers[1.2.3.5];
|
||||
print outfile, servers[1.2.3.6];
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,13 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
#
|
||||
# only difference from predicate.bro is, that this one uses a stream source.
|
||||
# the reason is, that the code-paths are quite different, because then the ascii reader uses the put and not the sendevent interface
|
||||
# the reason is, that the code-paths are quite different, because then the
|
||||
# ascii reader uses the put and not the sendevent interface
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
|
|
@ -19,6 +23,10 @@
|
|||
7 T
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -34,47 +42,38 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
global ct: int;
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: bool) {
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: bool)
|
||||
{
|
||||
ct = ct + 1;
|
||||
if ( ct < 3 ) {
|
||||
if ( ct < 3 )
|
||||
return;
|
||||
}
|
||||
if ( ct > 3 ) {
|
||||
print "Too many events";
|
||||
return;
|
||||
}
|
||||
|
||||
if ( 1 in servers ) {
|
||||
print "VALID";
|
||||
if ( 1 in servers )
|
||||
print outfile, "VALID";
|
||||
if ( 2 in servers )
|
||||
print outfile, "VALID";
|
||||
if ( !(3 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( !(4 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( !(5 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( !(6 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( 7 in servers )
|
||||
print outfile, "VALID";
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
if ( 2 in servers ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(3 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(4 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(5 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(6 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( 7 in servers ) {
|
||||
print "VALID";
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
{
|
||||
outfile = open("../out");
|
||||
ct = 0;
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="input.log", $mode=Input::STREAM, $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F, $ev=line,
|
||||
Input::add_table([$source="../input.log", $mode=Input::STREAM, $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F, $ev=line,
|
||||
$pred(typ: Input::Event, left: Idx, right: bool) = { return right; }
|
||||
]);
|
||||
Input::remove("input");
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -16,6 +19,10 @@
|
|||
7 T
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -31,34 +38,31 @@ type Val: record {
|
|||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F,
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F,
|
||||
$pred(typ: Input::Event, left: Idx, right: bool) = { return right; }
|
||||
]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
if ( 1 in servers ) {
|
||||
print "VALID";
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
if ( 1 in servers )
|
||||
print outfile, "VALID";
|
||||
if ( 2 in servers )
|
||||
print outfile, "VALID";
|
||||
if ( !(3 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( !(4 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( !(5 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( !(6 in servers) )
|
||||
print outfile, "VALID";
|
||||
if ( 7 in servers )
|
||||
print outfile, "VALID";
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
if ( 2 in servers ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(3 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(4 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(5 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( !(6 in servers) ) {
|
||||
print "VALID";
|
||||
}
|
||||
if ( 7 in servers ) {
|
||||
print "VALID";
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -11,6 +14,10 @@
|
|||
2 T test2 idx2
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -28,23 +35,25 @@ type Val: record {
|
|||
global servers: table[int, string] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=servers,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
if ( left$i == 1 ) {
|
||||
right$s = "testmodified";
|
||||
}
|
||||
{
|
||||
outfile = open("../out");
|
||||
|
||||
if ( left$i == 2 ) {
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
if ( left$i == 1 )
|
||||
right$s = "testmodified";
|
||||
if ( left$i == 2 )
|
||||
left$ss = "idxmodified";
|
||||
}
|
||||
return T;
|
||||
}
|
||||
]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print servers;
|
||||
}
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: cp input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro %INPUT
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: cp input2.log input.log
|
||||
# @TEST-EXEC: sleep 2
|
||||
|
|
@ -9,7 +11,7 @@
|
|||
# @TEST-EXEC: cp input4.log input.log
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: cp input5.log input.log
|
||||
# @TEST-EXEC: btest-bg-wait -k 3
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
#
|
||||
|
||||
|
|
@ -77,31 +79,31 @@ global outfile: file;
|
|||
global try: count;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
{
|
||||
try = 0;
|
||||
outfile = open ("../out");
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers, $mode=Input::REREAD,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
if ( left$i == 1 ) {
|
||||
if ( left$i == 1 )
|
||||
right$s = "testmodified";
|
||||
}
|
||||
|
||||
if ( left$i == 2 ) {
|
||||
if ( left$i == 2 )
|
||||
left$ss = "idxmodified";
|
||||
}
|
||||
return T;
|
||||
}
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
try = try + 1;
|
||||
print outfile, fmt("Update_finished for %s, try %d", name, try);
|
||||
print outfile, servers;
|
||||
|
||||
if ( try == 5 ) {
|
||||
close (outfile);
|
||||
if ( try == 5 )
|
||||
{
|
||||
close(outfile);
|
||||
Input::remove("input");
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -13,6 +16,10 @@ sdf
|
|||
3rw43wRRERLlL#RWERERERE.
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
module A;
|
||||
|
||||
|
|
@ -20,14 +27,23 @@ type Val: record {
|
|||
s: string;
|
||||
};
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string) {
|
||||
print description;
|
||||
print tpe;
|
||||
print s;
|
||||
}
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string)
|
||||
{
|
||||
print outfile, description;
|
||||
print outfile, tpe;
|
||||
print outfile, s;
|
||||
try = try + 1;
|
||||
if ( try == 8 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_event([$source="input.log", $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line]);
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
Input::add_event([$source="../input.log", $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
|
|
@ -10,6 +13,11 @@
|
|||
1 T
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
|
@ -27,15 +35,25 @@ global destination: table[int] of Val = table();
|
|||
const one_to_32: vector of count = {1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
for ( i in one_to_32 ) {
|
||||
Input::add_table([$source="input.log", $name=fmt("input%d", i), $idx=Idx, $val=Val, $destination=destination, $want_record=F]);
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
for ( i in one_to_32 )
|
||||
{
|
||||
Input::add_table([$source="../input.log", $name=fmt("input%d", i), $idx=Idx, $val=Val, $destination=destination, $want_record=F]);
|
||||
Input::remove(fmt("input%d", i));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print name;
|
||||
print source;
|
||||
print destination;
|
||||
}
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, name;
|
||||
print outfile, source;
|
||||
print outfile, destination;
|
||||
try = try + 1;
|
||||
if ( try == 32 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: cp input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro %INPUT
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: cp input2.log input.log
|
||||
# @TEST-EXEC: sleep 2
|
||||
|
|
@ -9,7 +11,7 @@
|
|||
# @TEST-EXEC: cp input4.log input.log
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: cp input5.log input.log
|
||||
# @TEST-EXEC: btest-bg-wait -k 2
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input1.log
|
||||
|
|
@ -56,6 +58,7 @@ F -48 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
|||
F -48 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/protocols/ssh
|
||||
@load frameworks/communication/listen
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
|
@ -90,7 +93,8 @@ global outfile: file;
|
|||
|
||||
global try: count;
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val) {
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val)
|
||||
{
|
||||
print outfile, "============EVENT============";
|
||||
print outfile, "Description";
|
||||
print outfile, description;
|
||||
|
|
@ -100,11 +104,11 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r
|
|||
print outfile, left;
|
||||
print outfile, "Right";
|
||||
print outfile, right;
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open ("../out");
|
||||
{
|
||||
outfile = open("../out");
|
||||
try = 0;
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh", $idx=Idx, $val=Val, $destination=servers, $ev=line,
|
||||
|
|
@ -116,17 +120,20 @@ event bro_init()
|
|||
return T;
|
||||
}
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, "==========SERVERS============";
|
||||
print outfile, servers;
|
||||
|
||||
try = try + 1;
|
||||
if ( try == 5 ) {
|
||||
if ( try == 5 )
|
||||
{
|
||||
print outfile, "done";
|
||||
close(outfile);
|
||||
Input::remove("input");
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -13,6 +16,10 @@ sdf
|
|||
3rw43wRRERLlL#RWERERERE.
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
module A;
|
||||
|
||||
|
|
@ -20,15 +27,24 @@ type Val: record {
|
|||
s: string;
|
||||
};
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string) {
|
||||
print description;
|
||||
print tpe;
|
||||
print s;
|
||||
}
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string)
|
||||
{
|
||||
print outfile, description;
|
||||
print outfile, tpe;
|
||||
print outfile, s;
|
||||
try = try + 1;
|
||||
if ( try == 16 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_event([$source="input.log", $reader=Input::READER_RAW, $mode=Input::REREAD, $name="input", $fields=Val, $ev=line]);
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
Input::add_event([$source="../input.log", $reader=Input::READER_RAW, $mode=Input::REREAD, $name="input", $fields=Val, $ev=line]);
|
||||
Input::force_update("input");
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,13 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: cp input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro %INPUT
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: sleep 3
|
||||
# @TEST-EXEC: cat input2.log >> input.log
|
||||
# @TEST-EXEC: sleep 3
|
||||
# @TEST-EXEC: cat input3.log >> input.log
|
||||
# @TEST-EXEC: btest-bg-wait -k 3
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input1.log
|
||||
|
|
@ -22,6 +24,7 @@ T -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
|||
F -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/protocols/ssh
|
||||
@load frameworks/communication/listen
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
|
@ -56,7 +59,8 @@ global outfile: file;
|
|||
|
||||
global try: count;
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val) {
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val)
|
||||
{
|
||||
print outfile, "============EVENT============";
|
||||
print outfile, tpe;
|
||||
print outfile, left;
|
||||
|
|
@ -66,18 +70,19 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r
|
|||
|
||||
try = try + 1;
|
||||
|
||||
if ( try == 3 ) {
|
||||
if ( try == 3 )
|
||||
{
|
||||
print outfile, "done";
|
||||
close(outfile);
|
||||
Input::remove("input");
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open ("../out");
|
||||
{
|
||||
outfile = open("../out");
|
||||
try = 0;
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $mode=Input::STREAM, $name="ssh", $idx=Idx, $val=Val, $destination=servers, $ev=line]);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: cp input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
|
|
@ -5,7 +7,7 @@
|
|||
# @TEST-EXEC: cat input2.log >> input.log
|
||||
# @TEST-EXEC: sleep 3
|
||||
# @TEST-EXEC: cat input3.log >> input.log
|
||||
# @TEST-EXEC: btest-bg-wait -k 3
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input1.log
|
||||
|
|
@ -36,21 +38,25 @@ type Val: record {
|
|||
global try: count;
|
||||
global outfile: file;
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string) {
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, s: string)
|
||||
{
|
||||
print outfile, description;
|
||||
print outfile, tpe;
|
||||
print outfile, s;
|
||||
|
||||
if ( try == 3 ) {
|
||||
|
||||
try = try + 1;
|
||||
if ( try == 8 )
|
||||
{
|
||||
print outfile, "done";
|
||||
close(outfile);
|
||||
Input::remove("input");
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open ("../out");
|
||||
{
|
||||
outfile = open("../out");
|
||||
try = 0;
|
||||
Input::add_event([$source="../input.log", $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line]);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >out
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
|
|
@ -16,6 +19,11 @@
|
|||
7 T
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
type Idx: record {
|
||||
|
|
@ -28,15 +36,24 @@ type Val: record {
|
|||
|
||||
global destination: table[int] of Val = table();
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: bool) {
|
||||
print description;
|
||||
print tpe;
|
||||
print left;
|
||||
print right;
|
||||
}
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: bool)
|
||||
{
|
||||
print outfile, description;
|
||||
print outfile, tpe;
|
||||
print outfile, left;
|
||||
print outfile, right;
|
||||
try = try + 1;
|
||||
if ( try == 7 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F,$ev=line]);
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F,$ev=line]);
|
||||
Input::remove("input");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,10 +1,15 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: cp input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro %INPUT
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: sleep 5
|
||||
# @TEST-EXEC: cp input3.log input.log
|
||||
# @TEST-EXEC: btest-bg-wait -k 2
|
||||
# @TEST-EXEC: btest-diff out
|
||||
# @TEST-EXEC: btest-bg-wait -k 10
|
||||
# @TEST-EXEC: btest-diff event.out
|
||||
# @TEST-EXEC: btest-diff pred1.out
|
||||
# @TEST-EXEC: btest-diff pred2.out
|
||||
# @TEST-EXEC: btest-diff fin.out
|
||||
|
||||
@TEST-START-FILE input1.log
|
||||
#separator \x09
|
||||
|
|
@ -28,6 +33,7 @@ T -43 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz
|
|||
F -44 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/protocols/ssh
|
||||
@load frameworks/communication/listen
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
|
@ -58,59 +64,71 @@ type Val: record {
|
|||
|
||||
global servers: table[int] of Val = table();
|
||||
|
||||
global outfile: file;
|
||||
global event_out: file;
|
||||
global pred1_out: file;
|
||||
global pred2_out: file;
|
||||
global fin_out: file;
|
||||
|
||||
global try: count;
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val) {
|
||||
print outfile, "============EVENT============";
|
||||
# print outfile, "Description";
|
||||
# print outfile, description;
|
||||
# print outfile, "Type";
|
||||
# print outfile, tpe;
|
||||
# print outfile, "Left";
|
||||
# print outfile, left;
|
||||
# print outfile, "Right";
|
||||
# print outfile, right;
|
||||
}
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val)
|
||||
{
|
||||
print event_out, "============EVENT============";
|
||||
# print event_out, "Description";
|
||||
# print event_out, description;
|
||||
# print event_out, "Type";
|
||||
# print event_out, tpe;
|
||||
# print event_out, "Left";
|
||||
# print event_out, left;
|
||||
# print event_out, "Right";
|
||||
# print event_out, right;
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open ("../out");
|
||||
{
|
||||
event_out = open ("../event.out");
|
||||
pred1_out = open ("../pred1.out");
|
||||
pred2_out = open ("../pred2.out");
|
||||
fin_out = open ("../fin.out");
|
||||
try = 0;
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh", $idx=Idx, $val=Val, $destination=servers, $ev=line,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
print outfile, "============PREDICATE============";
|
||||
print outfile, typ;
|
||||
print outfile, left;
|
||||
print outfile, right;
|
||||
print pred1_out, "============PREDICATE============";
|
||||
print pred1_out, typ;
|
||||
print pred1_out, left;
|
||||
print pred1_out, right;
|
||||
return T;
|
||||
}
|
||||
]);
|
||||
Input::add_table([$source="../input2.log", $mode=Input::REREAD, $name="ssh2", $idx=Idx, $val=Val, $destination=servers, $ev=line,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
print outfile, "============PREDICATE 2============";
|
||||
print outfile, typ;
|
||||
print outfile, left;
|
||||
print outfile, right;
|
||||
print pred2_out, "============PREDICATE 2============";
|
||||
print pred2_out, typ;
|
||||
print pred2_out, left;
|
||||
print pred2_out, right;
|
||||
return T;
|
||||
}
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event Input::update_finished(name: string, source: string) {
|
||||
print outfile, "==========SERVERS============";
|
||||
print outfile, servers;
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print fin_out, "==========SERVERS============";
|
||||
#print fin_out, servers;
|
||||
|
||||
try = try + 1;
|
||||
if ( try == 3 ) {
|
||||
print outfile, "done";
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
if ( try == 3 )
|
||||
{
|
||||
print fin_out, "done";
|
||||
print fin_out, servers;
|
||||
close(event_out);
|
||||
close(pred1_out);
|
||||
close(pred2_out);
|
||||
close(fin_out);
|
||||
Input::remove("input");
|
||||
Input::remove("input2");
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue