Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Updates for the notices framework.

Browse source 
- Moved the Notice::notice event and Notice::policy table to both be hooks.

 - Renamed the old Notice::policy to Notice::policy_table and documented it as deprecated.
This commit is contained in:
Seth Hall 2013-02-11 14:36:14 -05:00
parent a2556642e6
commit 9f8ba408ba
19 changed files with 129 additions and 159 deletions
Download patch file Download diff file Expand all files Collapse all files

24
testing/btest/scripts/base/frameworks/metrics/notice.bro
View file

@ -1,24 +0,0 @@
# @TEST-EXEC: bro %INPUT
# @TEST-EXEC: btest-diff notice.log
redef enum Notice::Type += {
Test_Notice,
};
redef enum Metrics::ID += {
TEST_METRIC,
};
event bro_init() &priority=5
{
Metrics::add_filter(TEST_METRIC,
[$name="foo-bar",
$break_interval=3secs,
$note=Test_Notice,
$notice_threshold=2,
$log=F]);
Metrics::add_data(TEST_METRIC, [$host=1.2.3.4], 3);
Metrics::add_data(TEST_METRIC, [$host=6.5.4.3], 2);
Metrics::add_data(TEST_METRIC, [$host=7.2.1.5], 1);
}

6
testing/btest/scripts/base/frameworks/notice/mail-alarms.bro
View file

@ -1,7 +1,11 @@
# @TEST-EXEC: bro -C -r $TRACES/web.trace %INPUT
# @TEST-EXEC: btest-diff alarm-mail.txt
redef Notice::policy += { [$action = Notice::ACTION_ALARM, $priority = 1 ] };
hook Notice::policy(n: Notice::Info) &priority=1
{
add n$actions[Notice::ACTION_ALARM];
}
redef Notice::force_email_summaries = T;
redef enum Notice::Type += {