Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

logging: Introduce Log::default_logdir deprecate LogAscii::logdir and per writer logdir

Browse source 
Also modify FormatRotationPath to keep rotated logs within
Log::default_logdir unless the rotation function explicitly
set dir, e.g. by when the user redef'ed default_rotation_interval.
This commit is contained in:
Arne Welzel 2022-06-30 16:07:04 +02:00
parent 513ea7e04f
commit aaa47a709c
15 changed files with 272 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/base/frameworks/logging/rotate-ascii-logdir-leftover-log-rotation-stale-shadow-files.zeek
View file

@ -7,7 +7,7 @@
# @TEST-EXEC: ! test -f logs/.shadow.conn.log
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: TEST_DIFF_CANONIFIER='$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps' btest-diff out
module GLOBAL;

2
testing/btest/scripts/base/frameworks/logging/rotate-ascii-logdir-leftover-log-rotation.zeek
View file

@ -3,7 +3,7 @@
# @TEST-EXEC: zeek -b -r ${TRACES}/rotation.trace %INPUT >zeek.out 2>&1
# @TEST-EXEC: grep "test" zeek.out | sort >out
# @TEST-EXEC: for i in `ls test.*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: TEST_DIFF_CANONIFIER='$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps' btest-diff out
module Test;

34
testing/btest/scripts/base/frameworks/logging/rotate-default-logdir-leftover-log-rotation-shadow-files.zeek Normal file
View file

@ -0,0 +1,34 @@
# @TEST-DOC: Test that .shadow files are picked up from Log::default_logdir.
# @TEST-EXEC: mkdir logs
# @TEST-EXEC: echo ".log" >> logs/.shadow.conn.log
# @TEST-EXEC: echo "my_rotation_postprocessor" >> logs/.shadow.conn.log
# @TEST-EXEC: echo "leftover conn log" > logs/conn.log
# @TEST-EXEC: echo ".log" >> logs/.shadow.dns.log
# @TEST-EXEC: echo "my_rotation_postprocessor" >> logs/.shadow.dns.log
# @TEST-EXEC: echo "leftover dns log" > logs/dns.log
# @TEST-EXEC: zeek -b %INPUT > out
# @TEST-EXEC: ! test -f logs/.shadow.conn.log
# @TEST-EXEC: ! test -f logs/conn.log
# @TEST-EXEC: ! test -f logs/.shadow.dns.log
# @TEST-EXEC: ! test -f logs/dns.log
# Ensure rotated logs ends-up in the ./logs directory.
# @TEST-EXEC: cat ./logs/conn-*.log ./logs/dns-*.log > logs.cat
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
# @TEST-EXEC: btest-diff logs.cat
module GLOBAL;
function my_rotation_postprocessor(info: Log::RotationInfo) : bool
{
print fmt("running my rotation postprocessor for path '%s'", info$path);
return T;
}
redef LogAscii::enable_leftover_log_rotation = T;
redef Log::default_logdir = "./logs";
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "echo";

23
testing/btest/scripts/base/frameworks/logging/rotate-default-logdir-leftover-log-rotation-stale-shadow-files.zeek Normal file
View file

@ -0,0 +1,23 @@
# @TEST-DOC: Test that stale .shadow files are removed from ::default_logdir
# @TEST-EXEC: mkdir logs
# @TEST-EXEC: echo ".log" >> logs/.shadow.conn.log
# @TEST-EXEC: echo "my_rotation_postprocessor" >> logs/.shadow.conn.log
# @TEST-EXEC: zeek -b %INPUT > out 2>&1
# @TEST-EXEC: ! test -f logs/.shadow.conn.log
# @TEST-EXEC: TEST_DIFF_CANONIFIER='$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps' btest-diff out
module GLOBAL;
function my_rotation_postprocessor(info: Log::RotationInfo) : bool
{
print fmt("running my rotation postprocessor for path '%s'", info$path);
return T;
}
redef Log::default_logdir = "./logs";
redef LogAscii::enable_leftover_log_rotation = T;
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "echo";

34
testing/btest/scripts/base/frameworks/logging/rotate-default-logdir.zeek Normal file
View file

@ -0,0 +1,34 @@
# @TEST-DOC: Set Log::default_logdir to ./logs. Ensure logs stay within ./logs.
# @TEST-EXEC: mkdir logs
# @TEST-EXEC: zeek -b -r ${TRACES}/rotation.trace %INPUT >zeek.out 2>&1
# @TEST-EXEC: grep "test" zeek.out | sort >out
# @TEST-EXEC: for i in `ls ./logs/test.*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out
# @TEST-EXEC: btest-diff out
module Test;
export {
# Create a new ID for our log stream
redef enum Log::ID += { LOG };
# Define a record with all the columns the log file can have.
# (I'm using a subset of fields from ssh-ext for demonstration.)
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
} &log;
}
redef Log::default_logdir = "./logs";
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "echo";
event zeek_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
}
event new_connection(c: connection)
{
Log::write(Test::LOG, [$t=network_time(), $id=c$id]);
}