mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Add more cluster and communication framework documentation.
This commit is contained in:
parent
1f57827e54
commit
8e89d78788
6 changed files with 86 additions and 16 deletions
|
@ -9,10 +9,10 @@ redef peer_description = Cluster::node;
|
||||||
# Add a cluster prefix.
|
# Add a cluster prefix.
|
||||||
@prefixes += cluster
|
@prefixes += cluster
|
||||||
|
|
||||||
## If this script isn't found anywhere, the cluster bombs out.
|
# If this script isn't found anywhere, the cluster bombs out.
|
||||||
## Loading the cluster framework requires that a script by this name exists
|
# Loading the cluster framework requires that a script by this name exists
|
||||||
## somewhere in the BROPATH. The only thing in the file should be the
|
# somewhere in the BROPATH. The only thing in the file should be the
|
||||||
## cluster definition in the :bro:id:`Cluster::nodes` variable.
|
# cluster definition in the :bro:id:`Cluster::nodes` variable.
|
||||||
@load cluster-layout
|
@load cluster-layout
|
||||||
|
|
||||||
@if ( Cluster::node in Cluster::nodes )
|
@if ( Cluster::node in Cluster::nodes )
|
||||||
|
|
|
@ -1,21 +1,45 @@
|
||||||
|
##! A framework for establishing and controlling a cluster of Bro instances.
|
||||||
|
##! In order to use the cluster framework, a script named
|
||||||
|
##! ``cluster-layout.bro`` must exist somewhere in Bro's script search path
|
||||||
|
##! which has a cluster definition of the :bro:id:`Cluster::nodes` variable.
|
||||||
|
##! The ``CLUSTER_NODE`` environment variable or :bro:id:`Cluster::node`
|
||||||
|
##! must also be sent and the cluster framework loaded as a package like
|
||||||
|
##! ``@load base/frameworks/cluster``.
|
||||||
|
|
||||||
@load base/frameworks/control
|
@load base/frameworks/control
|
||||||
|
|
||||||
module Cluster;
|
module Cluster;
|
||||||
|
|
||||||
export {
|
export {
|
||||||
|
## The cluster logging stream identifier.
|
||||||
redef enum Log::ID += { LOG };
|
redef enum Log::ID += { LOG };
|
||||||
|
|
||||||
|
## The record type which contains the column fields of the cluster log.
|
||||||
type Info: record {
|
type Info: record {
|
||||||
|
## The time at which a cluster message was generated.
|
||||||
ts: time;
|
ts: time;
|
||||||
|
## A message indicating information about the cluster's operation.
|
||||||
message: string;
|
message: string;
|
||||||
} &log;
|
} &log;
|
||||||
|
|
||||||
|
## Types of nodes that are allowed to participate in the cluster
|
||||||
|
## configuration.
|
||||||
type NodeType: enum {
|
type NodeType: enum {
|
||||||
|
## A dummy node type indicating the local node is not operating
|
||||||
|
## within a cluster.
|
||||||
NONE,
|
NONE,
|
||||||
|
## A node type which is allowed to view/manipulate the configuration
|
||||||
|
## of other nodes in the cluster.
|
||||||
CONTROL,
|
CONTROL,
|
||||||
|
## A node type responsible for log and policy management.
|
||||||
MANAGER,
|
MANAGER,
|
||||||
|
## A node type for relaying worker node communication and synchronizing
|
||||||
|
## worker node state.
|
||||||
PROXY,
|
PROXY,
|
||||||
|
## The node type doing all the actual traffic analysis.
|
||||||
WORKER,
|
WORKER,
|
||||||
|
## A node acting as a traffic recorder using the
|
||||||
|
## `Time Machine <http://tracker.bro-ids.org/time-machine>`_ software.
|
||||||
TIME_MACHINE,
|
TIME_MACHINE,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -49,30 +73,38 @@ export {
|
||||||
|
|
||||||
## Record type to indicate a node in a cluster.
|
## Record type to indicate a node in a cluster.
|
||||||
type Node: record {
|
type Node: record {
|
||||||
|
## Identifies the type of cluster node in this node's configuration.
|
||||||
node_type: NodeType;
|
node_type: NodeType;
|
||||||
|
## The IP address of the cluster node.
|
||||||
ip: addr;
|
ip: addr;
|
||||||
|
## The port to which the this local node can connect when
|
||||||
|
## establishing communication.
|
||||||
p: port;
|
p: port;
|
||||||
|
|
||||||
## Identifier for the interface a worker is sniffing.
|
## Identifier for the interface a worker is sniffing.
|
||||||
interface: string &optional;
|
interface: string &optional;
|
||||||
|
## Name of the manager node this node uses. For workers and proxies.
|
||||||
## Manager node this node uses. For workers and proxies.
|
|
||||||
manager: string &optional;
|
manager: string &optional;
|
||||||
## Proxy node this node uses. For workers and managers.
|
## Name of the proxy node this node uses. For workers and managers.
|
||||||
proxy: string &optional;
|
proxy: string &optional;
|
||||||
## Worker nodes that this node connects with. For managers and proxies.
|
## Names of worker nodes that this node connects with.
|
||||||
|
## For managers and proxies.
|
||||||
workers: set[string] &optional;
|
workers: set[string] &optional;
|
||||||
|
## Name of a time machine node with which this node connects.
|
||||||
time_machine: string &optional;
|
time_machine: string &optional;
|
||||||
};
|
};
|
||||||
|
|
||||||
## This function can be called at any time to determine if the cluster
|
## This function can be called at any time to determine if the cluster
|
||||||
## framework is being enabled for this run.
|
## framework is being enabled for this run.
|
||||||
|
##
|
||||||
|
## Returns: True if :bro:id:`Cluster::node` has been set.
|
||||||
global is_enabled: function(): bool;
|
global is_enabled: function(): bool;
|
||||||
|
|
||||||
## This function can be called at any time to determine what type of
|
## This function can be called at any time to determine what type of
|
||||||
## cluster node the current Bro instance is going to be acting as.
|
## cluster node the current Bro instance is going to be acting as.
|
||||||
## If :bro:id:`Cluster::is_enabled` returns false, then
|
## If :bro:id:`Cluster::is_enabled` returns false, then
|
||||||
## :bro:enum:`Cluster::NONE` is returned.
|
## :bro:enum:`Cluster::NONE` is returned.
|
||||||
|
##
|
||||||
|
## Returns: The :bro:type:`Cluster::NodeType` the calling node acts as.
|
||||||
global local_node_type: function(): NodeType;
|
global local_node_type: function(): NodeType;
|
||||||
|
|
||||||
## This gives the value for the number of workers currently connected to,
|
## This gives the value for the number of workers currently connected to,
|
||||||
|
|
|
@ -1,3 +1,7 @@
|
||||||
|
##! Redefines the options common to all proxy nodes within a Bro cluster.
|
||||||
|
##! In particular, proxies are not meant to produce logs locally and they
|
||||||
|
##! do not forward events anywhere, they mainly synchronize state between
|
||||||
|
##! worker nodes.
|
||||||
|
|
||||||
@prefixes += cluster-proxy
|
@prefixes += cluster-proxy
|
||||||
|
|
||||||
|
|
|
@ -1,3 +1,7 @@
|
||||||
|
##! Redefines some options common to all worker nodes within a Bro cluster.
|
||||||
|
##! In particular, worker nodes do not produce logs locally, instead they
|
||||||
|
##! send them off to a manager node for processing.
|
||||||
|
|
||||||
@prefixes += cluster-worker
|
@prefixes += cluster-worker
|
||||||
|
|
||||||
## Don't do any local logging.
|
## Don't do any local logging.
|
||||||
|
|
|
@ -1,3 +1,6 @@
|
||||||
|
##! This script establishes communication among all nodes in a cluster
|
||||||
|
##! as defined by :bro:id:`Cluster::nodes`.
|
||||||
|
|
||||||
@load ./main
|
@load ./main
|
||||||
@load base/frameworks/communication
|
@load base/frameworks/communication
|
||||||
|
|
||||||
|
|
|
@ -1,11 +1,13 @@
|
||||||
##! Connect to remote Bro or Broccoli instances to share state and/or transfer
|
##! Facilitates connecting to remote Bro or Broccoli instances to share state
|
||||||
##! events.
|
##! and/or transfer events.
|
||||||
|
|
||||||
@load base/frameworks/packet-filter
|
@load base/frameworks/packet-filter
|
||||||
|
|
||||||
module Communication;
|
module Communication;
|
||||||
|
|
||||||
export {
|
export {
|
||||||
|
|
||||||
|
## The communication logging stream identifier.
|
||||||
redef enum Log::ID += { LOG };
|
redef enum Log::ID += { LOG };
|
||||||
|
|
||||||
## Which interface to listen on (0.0.0.0 for any interface).
|
## Which interface to listen on (0.0.0.0 for any interface).
|
||||||
|
@ -21,14 +23,25 @@ export {
|
||||||
## compression.
|
## compression.
|
||||||
global compression_level = 0 &redef;
|
global compression_level = 0 &redef;
|
||||||
|
|
||||||
|
## A record type containing the column fields of the communication log.
|
||||||
type Info: record {
|
type Info: record {
|
||||||
|
## The network time at which a communication event occurred.
|
||||||
ts: time &log;
|
ts: time &log;
|
||||||
|
## The peer name (if any) for which a communication event is concerned.
|
||||||
peer: string &log &optional;
|
peer: string &log &optional;
|
||||||
|
## Where the communication event message originated from, that is,
|
||||||
|
## either from the scripting layer or inside the Bro process.
|
||||||
src_name: string &log &optional;
|
src_name: string &log &optional;
|
||||||
|
## .. todo:: currently unused.
|
||||||
connected_peer_desc: string &log &optional;
|
connected_peer_desc: string &log &optional;
|
||||||
|
## .. todo:: currently unused.
|
||||||
connected_peer_addr: addr &log &optional;
|
connected_peer_addr: addr &log &optional;
|
||||||
|
## .. todo:: currently unused.
|
||||||
connected_peer_port: port &log &optional;
|
connected_peer_port: port &log &optional;
|
||||||
|
## The severity of the communication event message.
|
||||||
level: string &log &optional;
|
level: string &log &optional;
|
||||||
|
## A message describing the communication event between Bro or
|
||||||
|
## Broccoli instances.
|
||||||
message: string &log;
|
message: string &log;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -77,7 +90,7 @@ export {
|
||||||
auth: bool &default = F;
|
auth: bool &default = F;
|
||||||
|
|
||||||
## If not set, no capture filter is sent.
|
## If not set, no capture filter is sent.
|
||||||
## If set to "", the default cature filter is sent.
|
## If set to "", the default capture filter is sent.
|
||||||
capture_filter: string &optional;
|
capture_filter: string &optional;
|
||||||
|
|
||||||
## Whether to use SSL-based communication.
|
## Whether to use SSL-based communication.
|
||||||
|
@ -96,11 +109,25 @@ export {
|
||||||
## The table of Bro or Broccoli nodes that Bro will initiate connections
|
## The table of Bro or Broccoli nodes that Bro will initiate connections
|
||||||
## to or respond to connections from.
|
## to or respond to connections from.
|
||||||
global nodes: table[string] of Node &redef;
|
global nodes: table[string] of Node &redef;
|
||||||
|
|
||||||
|
## A table of peer nodes for which this node issued a
|
||||||
|
## :bro:id:`Communication::connect_peer` call but with which a connection
|
||||||
|
## has not yet been established or with which a connection has been
|
||||||
|
## closed and is currently in the process of retrying to establish.
|
||||||
|
## When a connection is successfully established, the peer is removed
|
||||||
|
## from the table.
|
||||||
global pending_peers: table[peer_id] of Node;
|
global pending_peers: table[peer_id] of Node;
|
||||||
|
|
||||||
|
## A table of peer nodes for which this node has an established connection.
|
||||||
|
## Peers are automatically removed if their connection is closed and
|
||||||
|
## automatically added back if a connection is re-established later.
|
||||||
global connected_peers: table[peer_id] of Node;
|
global connected_peers: table[peer_id] of Node;
|
||||||
|
|
||||||
## Connect to nodes[node], independent of its "connect" flag.
|
## Connect to a node in :bro:id:`Communication::nodes` independent
|
||||||
|
## of its "connect" flag.
|
||||||
|
##
|
||||||
|
## peer: the string used to index a particular node within the
|
||||||
|
## :bro:id:`Communication::nodes` table.
|
||||||
global connect_peer: function(peer: string);
|
global connect_peer: function(peer: string);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue