Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Only the manager tries to read files with the input framework now.

Browse source
This commit is contained in:
Seth Hall 2012-10-10 13:00:48 -04:00
parent 5aa12984ee
commit 9ea52fe9cd
2 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/frameworks/intel/__load__.bro
View file

@ -1,5 +1,4 @@
@load ./main @load ./main
@load ./input
# The cluster framework must be loaded first. # The cluster framework must be loaded first.
@load base/frameworks/cluster @load base/frameworks/cluster
@ -7,3 +6,6 @@
@if ( Cluster::is_enabled() ) @if ( Cluster::is_enabled() )
@load ./cluster @load ./cluster
@endif @endif
# This needs cluster support to only read on the manager.
@load ./input

18
scripts/base/frameworks/intel/input.bro
View file

@ -16,14 +16,18 @@ event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item:
event bro_init() &priority=5 event bro_init() &priority=5
{ {
for ( a_file in read_files ) if ( ! Cluster::is_enabled() ||
Cluster::local_node_type() == Cluster::MANAGER )
{ {
Input::add_event([$source=a_file, for ( a_file in read_files )
$reader=Input::READER_ASCII, {
$mode=Input::REREAD, Input::add_event([$source=a_file,
$name=cat("intel-", a_file), $reader=Input::READER_ASCII,
$fields=Intel::Item, $mode=Input::REREAD,
$ev=Intel::read_entry]); $name=cat("intel-", a_file),
$fields=Intel::Item,
$ev=Intel::read_entry]);
}
} }
} }