diff --git a/CHANGES b/CHANGES index 57b1806893..915f3a4d1f 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,11 @@ +3.1.0-dev.30 | 2019-08-13 13:48:47 -0700 + + * Add new LogAscii::gzip_file_extension option. (Tim Wojtulewicz, Corelight) + + This can be used with the LogAscii::gzip_level option to set the file + extension of log files when they are compressed at creation time. + 3.1.0-dev.28 | 2019-08-13 12:01:44 -0700 * Remove redundant buffering in ContentLine analyzer (Justin Azoff) diff --git a/VERSION b/VERSION index 56791240da..8c1baa0e54 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.1.0-dev.28 +3.1.0-dev.30 diff --git a/aux/zeekctl b/aux/zeekctl index 0c0589c694..bddf60f395 160000 --- a/aux/zeekctl +++ b/aux/zeekctl @@ -1 +1 @@ -Subproject commit 0c0589c694555342463c879f18a26a810f563f76 +Subproject commit bddf60f395051abaedcf4f90f8c78a7371ac6227 diff --git a/doc b/doc index fdffd68e3d..db47d9bfe2 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit fdffd68e3dd021ce945c337855ef0d4e3a3a2b1d +Subproject commit db47d9bfe279b5f55722d89f8c8522ba501dcf1a diff --git a/scripts/base/frameworks/logging/writers/ascii.zeek b/scripts/base/frameworks/logging/writers/ascii.zeek index c06de02242..b9d89eb2a2 100644 --- a/scripts/base/frameworks/logging/writers/ascii.zeek +++ b/scripts/base/frameworks/logging/writers/ascii.zeek @@ -34,11 +34,18 @@ export { ## Define the gzip level to compress the logs. If 0, then no gzip ## compression is performed. Enabling compression also changes - ## the log file name extension to include ".gz". + ## the log file name extension to include the value of + ## :zeek:see:`LogAscii::gzip_file_extension`. ## ## This option is also available as a per-filter ``$config`` option. const gzip_level = 0 &redef; + ## Define the file extension used when compressing log files when + ## they are created with the :zeek:see:`LogAscii::gzip_level` option. + ## + ## This option is also available as a per-filter ``$config`` option. + const gzip_file_extension = "gz" &redef; + ## Format of timestamps when writing out JSON. By default, the JSON ## formatter will use double values for timestamps which represent the ## number of seconds from the UNIX epoch. diff --git a/src/logging/writers/ascii/Ascii.cc b/src/logging/writers/ascii/Ascii.cc index 79a6c49941..f598cdc216 100644 --- a/src/logging/writers/ascii/Ascii.cc +++ b/src/logging/writers/ascii/Ascii.cc @@ -71,6 +71,11 @@ void Ascii::InitConfigOptions() (const char*) tsfmt.Bytes(), tsfmt.Len() ); + + gzip_file_extension.assign( + (const char*) BifConst::LogAscii::gzip_file_extension->Bytes(), + BifConst::LogAscii::gzip_file_extension->Len() + ); } bool Ascii::InitFilterOptions() @@ -160,6 +165,9 @@ bool Ascii::InitFilterOptions() else if ( strcmp(i->first, "json_timestamps") == 0 ) json_timestamps.assign(i->second); + + else if ( strcmp(i->first, "gzip_file_extension") == 0 ) + gzip_file_extension.assign(i->second); } if ( ! InitFormatter() ) @@ -252,8 +260,13 @@ bool Ascii::DoInit(const WriterInfo& info, int num_fields, const Field* const * if ( output_to_stdout ) path = "/dev/stdout"; - fname = IsSpecial(path) ? path : path + "." + LogExt() + - (gzip_level > 0 ? ".gz" : ""); + fname = IsSpecial(path) ? path : path + "." + LogExt(); + + if ( gzip_level > 0 ) + { + fname += "."; + fname += gzip_file_extension.empty() ? "gz" : gzip_file_extension; + } fd = open(fname.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0666); @@ -427,8 +440,13 @@ bool Ascii::DoRotate(const char* rotated_path, double open, double close, bool t CloseFile(close); - string nname = string(rotated_path) + "." + LogExt() + - (gzip_level > 0 ? ".gz" : ""); + string nname = string(rotated_path) + "." + LogExt(); + + if ( gzip_level > 0 ) + { + nname += "."; + nname += gzip_file_extension.empty() ? "gz" : gzip_file_extension; + } if ( rename(fname.c_str(), nname.c_str()) != 0 ) { diff --git a/src/logging/writers/ascii/Ascii.h b/src/logging/writers/ascii/Ascii.h index 1ee9c29599..0fb147b0c7 100644 --- a/src/logging/writers/ascii/Ascii.h +++ b/src/logging/writers/ascii/Ascii.h @@ -64,6 +64,7 @@ private: string meta_prefix; int gzip_level; // level > 0 enables gzip compression + string gzip_file_extension; bool use_json; bool enable_utf_8; string json_timestamps; diff --git a/src/logging/writers/ascii/ascii.bif b/src/logging/writers/ascii/ascii.bif index d8263f07c0..b18b22a624 100644 --- a/src/logging/writers/ascii/ascii.bif +++ b/src/logging/writers/ascii/ascii.bif @@ -14,3 +14,4 @@ const use_json: bool; const enable_utf_8: bool; const json_timestamps: JSON::TimestampFormat; const gzip_level: count; +const gzip_file_extension: string; diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek index c240df96e5..37757a638e 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek @@ -1,12 +1,13 @@ # # @TEST-EXEC: zeek -b %INPUT -# @TEST-EXEC: gunzip ssh.log.gz +# @TEST-EXEC: gunzip -S .gzip ssh.log.gzip # @TEST-EXEC: btest-diff ssh.log # @TEST-EXEC: btest-diff ssh-uncompressed.log # # Testing all possible types. redef LogAscii::gzip_level = 9; +redef LogAscii::gzip_file_extension = "gzip"; module SSH;