Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

LogWriterAscii now prints time values w/ constant 6 digit precision.

Browse source 
closes #508
This commit is contained in:
Jon Siwek 2011-07-22 10:49:43 -05:00 • committed by Robin Sommer
parent 8dc1a52d9d
commit b05c34ed29
6 changed files with 83 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/LogWriterAscii.cc
View file

@ -141,8 +141,13 @@ bool LogWriterAscii::DoWriteOne(ODesc* desc, LogVal* val, const LogField* field)
desc->Add(dotted_addr(val->val.addr_val)); desc->Add(dotted_addr(val->val.addr_val));
break; break;
case TYPE_DOUBLE:
case TYPE_TIME: case TYPE_TIME:
char buf[32];
snprintf(buf, sizeof(buf), "%.6f", val->val.double_val);
desc->Add(buf);
break;
case TYPE_DOUBLE:
case TYPE_INTERVAL: case TYPE_INTERVAL:
desc->Add(val->val.double_val); desc->Add(val->val.double_val);
break; break;

9
testing/btest/Baseline/policy.frameworks.logging.ascii-timestamps/test.log Normal file
View file

@ -0,0 +1,9 @@
# data
1234567890.000000
1234567890.000000
1234567890.010000
1234567890.001000
1234567890.000100
1234567890.000010
1234567890.000001
1234567890.000000

40
testing/btest/Baseline/policy.frameworks.logging.rotate-custom/out
View file

@ -29,26 +29,26 @@
2nd test2-11-03-07_12.00.05.log test2.log 11-03-07_12.00.05 11-03-07_12.59.55 0 2nd test2-11-03-07_12.00.05.log test2.log 11-03-07_12.00.05 11-03-07_12.59.55 0
2nd test2-11-03-07_12.59.55.log test2.log 11-03-07_12.59.55 11-03-07_12.59.55 1 2nd test2-11-03-07_12.59.55.log test2.log 11-03-07_12.59.55 11-03-07_12.59.55 1
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299466805.0 10.0.0.1 20 10.0.0.2 1024 1299466805.000000 10.0.0.1 20 10.0.0.2 1024
1299470395.0 10.0.0.2 20 10.0.0.3 0 1299470395.000000 10.0.0.2 20 10.0.0.3 0
1299470405.0 10.0.0.1 20 10.0.0.2 1025 1299470405.000000 10.0.0.1 20 10.0.0.2 1025
1299473995.0 10.0.0.2 20 10.0.0.3 1 1299473995.000000 10.0.0.2 20 10.0.0.3 1
1299474005.0 10.0.0.1 20 10.0.0.2 1026 1299474005.000000 10.0.0.1 20 10.0.0.2 1026
1299477595.0 10.0.0.2 20 10.0.0.3 2 1299477595.000000 10.0.0.2 20 10.0.0.3 2
1299477605.0 10.0.0.1 20 10.0.0.2 1027 1299477605.000000 10.0.0.1 20 10.0.0.2 1027
1299481195.0 10.0.0.2 20 10.0.0.3 3 1299481195.000000 10.0.0.2 20 10.0.0.3 3
1299481205.0 10.0.0.1 20 10.0.0.2 1028 1299481205.000000 10.0.0.1 20 10.0.0.2 1028
1299484795.0 10.0.0.2 20 10.0.0.3 4 1299484795.000000 10.0.0.2 20 10.0.0.3 4
1299484805.0 10.0.0.1 20 10.0.0.2 1029 1299484805.000000 10.0.0.1 20 10.0.0.2 1029
1299488395.0 10.0.0.2 20 10.0.0.3 5 1299488395.000000 10.0.0.2 20 10.0.0.3 5
1299488405.0 10.0.0.1 20 10.0.0.2 1030 1299488405.000000 10.0.0.1 20 10.0.0.2 1030
1299491995.0 10.0.0.2 20 10.0.0.3 6 1299491995.000000 10.0.0.2 20 10.0.0.3 6
1299492005.0 10.0.0.1 20 10.0.0.2 1031 1299492005.000000 10.0.0.1 20 10.0.0.2 1031
1299495595.0 10.0.0.2 20 10.0.0.3 7 1299495595.000000 10.0.0.2 20 10.0.0.3 7
1299495605.0 10.0.0.1 20 10.0.0.2 1032 1299495605.000000 10.0.0.1 20 10.0.0.2 1032
1299499195.0 10.0.0.2 20 10.0.0.3 8 1299499195.000000 10.0.0.2 20 10.0.0.3 8
1299499205.0 10.0.0.1 20 10.0.0.2 1033 1299499205.000000 10.0.0.1 20 10.0.0.2 1033
1299502795.0 10.0.0.2 20 10.0.0.3 9 1299502795.000000 10.0.0.2 20 10.0.0.3 9
> test-11-03-07_03.00.05.log > test-11-03-07_03.00.05.log
> test-11-03-07_04.00.05.log > test-11-03-07_04.00.05.log
> test-11-03-07_05.00.05.log > test-11-03-07_05.00.05.log

40
testing/btest/Baseline/policy.frameworks.logging.rotate/out
View file

@ -10,41 +10,41 @@ test-11-03-07_11.00.05.log test.log 11-03-07_11.00.05 11-03-07_12.00.05 0
test-11-03-07_12.00.05.log test.log 11-03-07_12.00.05 11-03-07_12.59.55 1 test-11-03-07_12.00.05.log test.log 11-03-07_12.00.05 11-03-07_12.59.55 1
> test-11-03-07_03.00.05.log > test-11-03-07_03.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299466805.0 10.0.0.1 20 10.0.0.2 1024 1299466805.000000 10.0.0.1 20 10.0.0.2 1024
1299470395.0 10.0.0.2 20 10.0.0.3 0 1299470395.000000 10.0.0.2 20 10.0.0.3 0
> test-11-03-07_04.00.05.log > test-11-03-07_04.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299470405.0 10.0.0.1 20 10.0.0.2 1025 1299470405.000000 10.0.0.1 20 10.0.0.2 1025
1299473995.0 10.0.0.2 20 10.0.0.3 1 1299473995.000000 10.0.0.2 20 10.0.0.3 1
> test-11-03-07_05.00.05.log > test-11-03-07_05.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299474005.0 10.0.0.1 20 10.0.0.2 1026 1299474005.000000 10.0.0.1 20 10.0.0.2 1026
1299477595.0 10.0.0.2 20 10.0.0.3 2 1299477595.000000 10.0.0.2 20 10.0.0.3 2
> test-11-03-07_06.00.05.log > test-11-03-07_06.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299477605.0 10.0.0.1 20 10.0.0.2 1027 1299477605.000000 10.0.0.1 20 10.0.0.2 1027
1299481195.0 10.0.0.2 20 10.0.0.3 3 1299481195.000000 10.0.0.2 20 10.0.0.3 3
> test-11-03-07_07.00.05.log > test-11-03-07_07.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299481205.0 10.0.0.1 20 10.0.0.2 1028 1299481205.000000 10.0.0.1 20 10.0.0.2 1028
1299484795.0 10.0.0.2 20 10.0.0.3 4 1299484795.000000 10.0.0.2 20 10.0.0.3 4
> test-11-03-07_08.00.05.log > test-11-03-07_08.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299484805.0 10.0.0.1 20 10.0.0.2 1029 1299484805.000000 10.0.0.1 20 10.0.0.2 1029
1299488395.0 10.0.0.2 20 10.0.0.3 5 1299488395.000000 10.0.0.2 20 10.0.0.3 5
> test-11-03-07_09.00.05.log > test-11-03-07_09.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299488405.0 10.0.0.1 20 10.0.0.2 1030 1299488405.000000 10.0.0.1 20 10.0.0.2 1030
1299491995.0 10.0.0.2 20 10.0.0.3 6 1299491995.000000 10.0.0.2 20 10.0.0.3 6
> test-11-03-07_10.00.05.log > test-11-03-07_10.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299492005.0 10.0.0.1 20 10.0.0.2 1031 1299492005.000000 10.0.0.1 20 10.0.0.2 1031
1299495595.0 10.0.0.2 20 10.0.0.3 7 1299495595.000000 10.0.0.2 20 10.0.0.3 7
> test-11-03-07_11.00.05.log > test-11-03-07_11.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299495605.0 10.0.0.1 20 10.0.0.2 1032 1299495605.000000 10.0.0.1 20 10.0.0.2 1032
1299499195.0 10.0.0.2 20 10.0.0.3 8 1299499195.000000 10.0.0.2 20 10.0.0.3 8
> test-11-03-07_12.00.05.log > test-11-03-07_12.00.05.log
# t id.orig_h id.orig_p id.resp_h id.resp_p # t id.orig_h id.orig_p id.resp_h id.resp_p
1299499205.0 10.0.0.1 20 10.0.0.2 1033 1299499205.000000 10.0.0.1 20 10.0.0.2 1033
1299502795.0 10.0.0.2 20 10.0.0.3 9 1299502795.000000 10.0.0.2 20 10.0.0.3 9

2
testing/btest/Baseline/policy.protocols.dns.event-priority/dns.log
View file

@ -1,2 +1,2 @@
# ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name QR AA TC RD RA Z TTL answers auth addl # ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name QR AA TC RD RA Z TTL answers auth addl
930613226.52907 UWkUyAuUGXf 212.180.42.100 25000 131.243.64.3 53 tcp 34798 - - - - - 0 NOERROR F F F F T 0 31337.0 4.3.2.1 - - 930613226.529070 UWkUyAuUGXf 212.180.42.100 25000 131.243.64.3 53 tcp 34798 - - - - - 0 NOERROR F F F F T 0 31337.0 4.3.2.1 - -

27
testing/btest/policy/frameworks/logging/ascii-timestamps.bro Normal file
View file

@ -0,0 +1,27 @@
#
# @TEST-EXEC: bro %INPUT
# @TEST-EXEC: btest-diff test.log
module Test;
export {
redef enum Log::ID += { TEST };
type Info: record {
data: time &log;
};
}
event bro_init()
{
Log::create_stream(TEST, [$columns=Info]);
Log::write(TEST, [$data=double_to_time(1234567890)]);
Log::write(TEST, [$data=double_to_time(1234567890.0)]);
Log::write(TEST, [$data=double_to_time(1234567890.01)]);
Log::write(TEST, [$data=double_to_time(1234567890.001)]);
Log::write(TEST, [$data=double_to_time(1234567890.0001)]);
Log::write(TEST, [$data=double_to_time(1234567890.00001)]);
Log::write(TEST, [$data=double_to_time(1234567890.000001)]);
Log::write(TEST, [$data=double_to_time(1234567890.0000001)]);
}