Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/seth/zeek_init'

Browse source 
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
This commit is contained in:
Jon Siwek 2019-04-19 11:16:35 -07:00
commit a994be9eeb
628 changed files with 868 additions and 1082 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/policy/misc/capture-loss.zeek
View file

@ -74,7 +74,7 @@ event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps:
schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) };
}
event bro_init() &priority=5
event zeek_init() &priority=5
{
Log::create_stream(LOG, [$columns=Info, $path="capture_loss"]);

2
scripts/policy/misc/detect-traceroute/main.zeek
View file

@ -53,7 +53,7 @@ export {
global log_traceroute: event(rec: Traceroute::Info);
}
event bro_init() &priority=5
event zeek_init() &priority=5
{
Log::create_stream(Traceroute::LOG, [$columns=Info, $ev=log_traceroute, $path="traceroute"]);

2
scripts/policy/misc/load-balancing.zeek
View file

@ -28,7 +28,7 @@ export {
@if ( Cluster::is_enabled() )
event bro_init() &priority=5
event zeek_init() &priority=5
{
if ( method != AUTO_BPF )
return;

2
scripts/policy/misc/loaded-scripts.zeek
View file

@ -27,7 +27,7 @@ function get_indent(level: count): string
return out;
}
event bro_init() &priority=5
event zeek_init() &priority=5
{
Log::create_stream(LoadedScripts::LOG, [$columns=Info, $path="loaded_scripts"]);
}

2
scripts/policy/misc/profiling.zeek
View file

@ -12,7 +12,7 @@ redef profiling_interval = 15 secs;
## :bro:id:`profiling_interval`).
redef expensive_profiling_multiple = 20;
event bro_init()
event zeek_init()
{
set_buf(profiling_file, F);
}

2
scripts/policy/misc/scan.zeek
View file

@ -51,7 +51,7 @@ export {
global Scan::port_scan_policy: hook(scanner: addr, victim: addr, scanned_port: port);
}
event bro_init() &priority=5
event zeek_init() &priority=5
{
local r1: SumStats::Reducer = [$stream="scan.addr.fail", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(addr_scan_threshold+2)];
SumStats::create([$name="addr-scan",

4
scripts/policy/misc/stats.zeek
View file

@ -82,7 +82,7 @@ export {
global log_stats: event(rec: Info);
}
event bro_init() &priority=5
event zeek_init() &priority=5
{
Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats"]);
}
@ -149,7 +149,7 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr
schedule report_interval { check_stats(nettime, ns, cs, ps, es, rs, ts, fs, ds) };
}
event bro_init()
event zeek_init()
{
schedule report_interval { check_stats(network_time(), get_net_stats(), get_conn_stats(), get_proc_stats(), get_event_stats(), get_reassembler_stats(), get_timer_stats(), get_file_analysis_stats(), get_dns_stats()) };
}

2
scripts/policy/misc/trim-trace-file.zeek
View file

@ -30,7 +30,7 @@ event TrimTraceFile::go(first_trim: bool)
schedule trim_interval { TrimTraceFile::go(F) };
}
event bro_init()
event zeek_init()
{
if ( trim_interval > 0 secs )
schedule trim_interval { TrimTraceFile::go(T) };

2
scripts/policy/misc/weird-stats.zeek
View file

@ -51,7 +51,7 @@ function weird_epoch_finished(ts: time)
this_epoch_weirds = table();
}
event bro_init() &priority=5
event zeek_init() &priority=5
{
Log::create_stream(WeirdStats::LOG,
[$columns = Info, $ev = log_weird_stats,