Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Logging: implement get_filter_names and small fixes.

Browse source 
get_filter_names(id: ID) : set[string] returns the names of the current
list of filters for a specified log stream.

Furthermore this commit makes a number of logging functions more robust
by checking existence of values before trying to modify them. This
commit also really implements (and tests) the enable_stream function.
This commit is contained in:
Johanna Amann 2018-01-17 09:29:41 -08:00
parent fc6e3b4e36
commit a4a9bf4199
8 changed files with 263 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/base/frameworks/logging/adapt-filter.bro
View file

@ -27,7 +27,7 @@ event bro_init()
filter$path= "ssh-new-default";
Log::add_filter(SSH::LOG, filter);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
}

3
testing/btest/scripts/base/frameworks/logging/disable-stream.bro
View file

@ -21,13 +21,12 @@ event bro_init()
Log::disable_stream(SSH::LOG);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
}

33
testing/btest/scripts/base/frameworks/logging/enable-stream.bro Normal file
View file

@ -0,0 +1,33 @@
#
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;
export {
redef enum Log::ID += { LOG };
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
country: string &default="unknown";
} &log;
}
event bro_init()
{
Log::create_stream(SSH::LOG, [$columns=Log]);
Log::disable_stream(SSH::LOG);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::enable_stream(SSH::LOG);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
}

5
testing/btest/scripts/base/frameworks/logging/remove.bro
View file

@ -2,6 +2,7 @@
# @TEST-EXEC: bro -b -B logging %INPUT
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff ssh.failure.log
# @TEST-EXEC: btest-diff .stdout
module SSH;
@ -24,11 +25,12 @@ event bro_init()
Log::create_stream(SSH::LOG, [$columns=Log]);
Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
# Log something.
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
print Log::get_filter_names(SSH::LOG);
Log::remove_filter(SSH::LOG, "f1");
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="BR"]);
@ -37,5 +39,6 @@ event bro_init()
Log::write(SSH::LOG, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
Log::remove_filter(SSH::LOG, "doesn-not-exist");
print Log::get_filter_names(SSH::LOG);
}