Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add Log::rotation_format_func and Log::default_rotation_dir options

Browse source 
These may be redefined to customize log rotation path prefixes,
including use of a directory.  File extensions are still up to
individual log writers to add themselves during the actual rotation.

These new also allow for some simplication to the default
ASCII postprocessor function: it eliminates the need for it doing an
extra/awkward rename() operation that only changes the timestamp format.

This also teaches the supervisor framework to use these new options
to rotate ascii logs into a log-queue/ directory with a specific
file name format (intended for an external archiver process to
monitor separately).
This commit is contained in:
Jon Siwek 2020-06-27 22:43:37 -07:00
parent 6e67a40d24
commit a06ef66edc
21 changed files with 510 additions and 118 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/base/frameworks/cluster/nodes/logger.zeek
View file

@ -22,8 +22,24 @@ redef Log::default_rotation_interval = 1 hrs;
## Alarm summary mail interval.
redef Log::default_mail_alarms_interval = 24 hrs;
## Use the cluster's archive logging script.
@if ( Supervisor::is_supervised() )
@if ( ! Supervisor::is_supervised() )
redef Log::default_rotation_dir = "log-queue";
function supervisor_rotation_format_func(ri: Log::RotationFmtInfo): Log::RotationPath
{
local open_str = strftime(Log::default_rotation_date_format, ri$open);
local close_str = strftime(Log::default_rotation_date_format, ri$open);
local prefix = fmt("%s__%s__%s__", ri$path, open_str, close_str);
local rval = Log::RotationPath($file_prefix=prefix);
return rval;
}
redef Log::rotation_format_func = supervisor_rotation_format_func;
@else
## Use the cluster's archive logging script.
redef Log::default_rotation_postprocessor_cmd = "archive-log";
@endif

2
scripts/base/frameworks/cluster/nodes/manager.zeek
View file

@ -19,5 +19,7 @@ redef Log::enable_remote_logging = T;
## Log rotation interval.
redef Log::default_rotation_interval = 24 hrs;
@if ( ! Supervisor::is_supervised() )
## Use the cluster's delete-log script.
redef Log::default_rotation_postprocessor_cmd = "delete-log";
@endif

2
scripts/base/frameworks/cluster/nodes/proxy.zeek
View file

@ -13,6 +13,8 @@ redef Log::enable_remote_logging = T;
redef Log::default_rotation_interval = 24hrs;
@if ( ! Supervisor::is_supervised() )
## Use the cluster's delete-log script.
redef Log::default_rotation_postprocessor_cmd = "delete-log";
@endif

2
scripts/base/frameworks/cluster/nodes/worker.zeek
View file

@ -12,8 +12,10 @@ redef Log::enable_remote_logging = T;
redef Log::default_rotation_interval = 24hrs;
@if ( ! Supervisor::is_supervised() )
## Use the cluster's delete-log script.
redef Log::default_rotation_postprocessor_cmd = "delete-log";
@endif
@load misc/trim-trace-file
## Record all packets into trace file.