Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

logging/sqlite: Recognize Log::default_logdir and place files there if set

Browse source
This commit is contained in:
Arne Welzel 2022-07-06 12:13:32 +02:00
parent aaa47a709c
commit 93584c7c7f
5 changed files with 78 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/logging/writers/sqlite/SQLite.cc
View file

@ -10,6 +10,7 @@
#include "zeek/logging/writers/sqlite/sqlite.bif.h"
#include "zeek/threading/SerialTypes.h"
#include "zeek/util.h"
using namespace std;
using zeek::threading::Field;
@ -128,8 +129,11 @@ bool SQLite::DoInit(const WriterInfo& info, int arg_num_fields, const Field* con
num_fields = arg_num_fields;
fields = arg_fields;
string fullpath(info.path);
fullpath.append(".sqlite");
auto fullpath = zeek::filesystem::path(
zeek::id::find_const<StringVal>("Log::default_logdir")->ToStdString());
fullpath /= info.path;
fullpath += ".sqlite";
string tablename;
WriterInfo::config_map::const_iterator it = info.config.find("tablename");

3
testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.default-logdir/ls.logs Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
./logs/reporter.sqlite
./logs/test.sqlite

21
testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.default-logdir/test.select Normal file
View file

@ -0,0 +1,21 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1024
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|0
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1025
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|1
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1026
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|2
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1027
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|3
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1028
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|4
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1029
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|5
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1030
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|6
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1031
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|7
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1032
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|8
XXXXXXXXXX.XXXXXX|10.0.0.1|20|10.0.0.2|1033
XXXXXXXXXX.XXXXXX|10.0.0.2|20|10.0.0.3|9

2
testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.default-logdir/zeek.out Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
XXXXXXXXXX.XXXXXX test/Log::WRITER_SQLITE: tablename configuration option not found. Defaulting to path test

46
testing/btest/scripts/base/frameworks/logging/sqlite/default-logdir.zeek Normal file
View file

@ -0,0 +1,46 @@
#
# @TEST-REQUIRES: which sqlite3
# @TEST-REQUIRES: has-writer Zeek::SQLiteWriter
# @TEST-GROUP: sqlite
#
# @TEST-EXEC: mkdir logs
# @TEST-EXEC: zeek -b -r ${TRACES}/rotation.trace %INPUT >zeek.out 2>&1
# @TEST-EXEC: ls ./logs/* > ls.logs
# @TEST-EXEC: sqlite3 ./logs/test.sqlite 'select * from test' > test.select
# @TEST-EXEC: btest-diff test.select
# @TEST-EXEC: btest-diff ls.logs
# @TEST-EXEC: btest-diff zeek.out
#
# @TEST-DOC: Configure Log::default_writer, Log::default_logdir and ensure the test.sqlite database is in ./logs
redef Log::default_writer = Log::WRITER_SQLITE;
redef Log::default_logdir = "./logs";
# Also enable log-rotation, but it has no effect on sqlite.
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "echo";
redef LogSQLite::unset_field = "(unset)";
module Test;
export {
# Create a new ID for our log stream
redef enum Log::ID += { LOG };
# Define a record with all the columns the log file can have.
# (I'm using a subset of fields from ssh-ext for demonstration.)
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
} &log;
}
event zeek_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
}
event new_connection(c: connection)
{
Log::write(Test::LOG, [$t=network_time(), $id=c$id]);
}