Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Rename analyzer.log to analyzer.debug log; move to policy

Browse source 
The current analyzer.log is more useful for debugging than for
operational purposes. Hence this is disabled by default, moved to a
policy script, and the log is renamed to analyzer-debug.log.

Furthermore, logging of analyzer confirmations and disabling analyzers
are now enabled by default.
This commit is contained in:
Johanna Amann 2025-03-27 16:48:49 +00:00
parent 6183c5086b
commit c55e21da71
3 changed files with 41 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/frameworks/analyzer/__load__.zeek
View file

@ -1,3 +1,2 @@
@load ./main @load ./main
@load ./dpd @load ./dpd
@load ./logging

5
scripts/base/frameworks/analyzer/dpd.zeek
View file

@ -1,4 +1,5 @@
##! Disables analyzers if protocol violations occur. ##! Disables analyzers if protocol violations occur, and add service information
##! to connection log.
module DPD; module DPD;
@ -27,6 +28,7 @@ redef record connection += {
service_violation: set[string] &default=set() &ordered; service_violation: set[string] &default=set() &ordered;
}; };
## add confirmed protocol analyzers to conn.log service field
event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirmationInfo) &priority=10 event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirmationInfo) &priority=10
{ {
if ( ! is_protocol_analyzer(atype) && ! is_packet_analyzer(atype) ) if ( ! is_protocol_analyzer(atype) && ! is_packet_analyzer(atype) )
@ -40,6 +42,7 @@ event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirm
add c$service[analyzer]; add c$service[analyzer];
} }
## Remove failed analyzers from service field and add them to c$service_violation
event analyzer_violation_info(atype: AllAnalyzers::Tag, info: AnalyzerViolationInfo) &priority=10 event analyzer_violation_info(atype: AllAnalyzers::Tag, info: AnalyzerViolationInfo) &priority=10
{ {
if ( ! is_protocol_analyzer(atype) && ! is_packet_analyzer(atype) ) if ( ! is_protocol_analyzer(atype) && ! is_packet_analyzer(atype) )

50
scripts/base/frameworks/analyzer/logging.zeek → scripts/policy/frameworks/analyzer/analyzer-debug-log.zeek
View file

@ -1,11 +1,10 @@
##! Logging analyzer confirmations and violations into analyzer.log ##! Logging analyzer confirmations and violations into analyzer-debug.log
@load base/frameworks/config @load base/frameworks/config
@load base/frameworks/logging @load base/frameworks/logging
@load base/frameworks/analyzer
@load ./main module Analyzer::DebugLogging;
module Analyzer::Logging;
export { export {
## Add the analyzer logging stream identifier. ## Add the analyzer logging stream identifier.
@ -38,12 +37,12 @@ export {
failure_reason: string &log &optional; failure_reason: string &log &optional;
## Data causing failure or violation if available. Truncated ## Data causing failure or violation if available. Truncated
## to :zeek:see:`Analyzer::Logging::failure_data_max_size`. ## to :zeek:see:`Analyzer::DebugLogging::failure_data_max_size`.
failure_data: string &log &optional; failure_data: string &log &optional;
}; };
## Enable logging of analyzer violations and optionally confirmations ## Enable logging of analyzer violations and optionally confirmations
## when :zeek:see:`Analyzer::Logging::include_confirmations` is set. ## when :zeek:see:`Analyzer::DebugLogging::include_confirmations` is set.
option enable = T; option enable = T;
## Enable analyzer_confirmation. They are usually less interesting ## Enable analyzer_confirmation. They are usually less interesting
@ -51,13 +50,13 @@ export {
## Setting this option may also generated multiple log entries per ## Setting this option may also generated multiple log entries per
## connection, minimally one for each conn.log entry with a populated ## connection, minimally one for each conn.log entry with a populated
## service field. ## service field.
option include_confirmations = F; option include_confirmations = T;
## Enable tracking of analyzers getting disabled. This is mostly ## Enable tracking of analyzers getting disabled. This is mostly
## interesting for troubleshooting of analyzers in DPD scenarios. ## interesting for troubleshooting of analyzers in DPD scenarios.
## Setting this option may also generated multiple log entries per ## Setting this option may also generated multiple log entries per
## connection. ## connection.
option include_disabling = F; option include_disabling = T;
## If a violation contains information about the data causing it, ## If a violation contains information about the data causing it,
## include at most this many bytes of it in the log. ## include at most this many bytes of it in the log.
@ -70,8 +69,8 @@ export {
event zeek_init() &priority=5 event zeek_init() &priority=5
{ {
Log::create_stream(LOG, [$columns=Info, $path="analyzer", $policy=log_policy, Log::create_stream(LOG, [$columns=Info, $path="analyzer-debug", $policy=log_policy,
$event_groups=set("Analyzer::Logging")]); $event_groups=set("Analyzer::DebugLogging")]);
local enable_handler = function(id: string, new_value: bool): bool { local enable_handler = function(id: string, new_value: bool): bool {
if ( new_value ) if ( new_value )
@ -81,37 +80,40 @@ event zeek_init() &priority=5
return new_value; return new_value;
}; };
Option::set_change_handler("Analyzer::Logging::enable", enable_handler);
Option::set_change_handler("Analyzer::DebugLogging::enable", enable_handler);
local include_confirmations_handler = function(id: string, new_value: bool): bool { local include_confirmations_handler = function(id: string, new_value: bool): bool {
if ( new_value ) if ( new_value )
enable_event_group("Analyzer::Logging::include_confirmations"); enable_event_group("Analyzer::DebugLogging::include_confirmations");
else else
disable_event_group("Analyzer::Logging::include_confirmations"); disable_event_group("Analyzer::DebugLogging::include_confirmations");
return new_value; return new_value;
}; };
Option::set_change_handler("Analyzer::Logging::include_confirmations",
Option::set_change_handler("Analyzer::DebugLogging::include_confirmations",
include_confirmations_handler); include_confirmations_handler);
local include_disabling_handler = function(id: string, new_value: bool): bool { local include_disabling_handler = function(id: string, new_value: bool): bool {
if ( new_value ) if ( new_value )
enable_event_group("Analyzer::Logging::include_disabling"); enable_event_group("Analyzer::DebugLogging::include_disabling");
else else
disable_event_group("Analyzer::Logging::include_disabling"); disable_event_group("Analyzer::DebugLogging::include_disabling");
return new_value; return new_value;
}; };
Option::set_change_handler("Analyzer::Logging::include_disabling",
Option::set_change_handler("Analyzer::DebugLogging::include_disabling",
include_disabling_handler); include_disabling_handler);
# Call the handlers directly with the current values to avoid config # Call the handlers directly with the current values to avoid config
# framework interactions like creating entries in config.log. # framework interactions like creating entries in config.log.
enable_handler("Analyzer::Logging::enable", Analyzer::Logging::enable); enable_handler("Analyzer::DebugLogging::enable", Analyzer::DebugLogging::enable);
include_confirmations_handler("Analyzer::Logging::include_confirmations", include_confirmations_handler("Analyzer::DebugLogging::include_confirmations",
Analyzer::Logging::include_confirmations); Analyzer::DebugLogging::include_confirmations);
include_disabling_handler("Analyzer::Logging::include_disabling", include_disabling_handler("Analyzer::DebugLogging::include_disabling",
Analyzer::Logging::include_disabling); Analyzer::DebugLogging::include_disabling);
} }
@ -149,7 +151,7 @@ function populate_from_file(rec: Info, f: fa_file)
} }
} }
event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirmationInfo) &group="Analyzer::Logging::include_confirmations" event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirmationInfo) &group="Analyzer::DebugLogging::include_confirmations"
{ {
if ( atype in ignore_analyzers ) if ( atype in ignore_analyzers )
return; return;
@ -200,7 +202,7 @@ event analyzer_violation_info(atype: AllAnalyzers::Tag, info: AnalyzerViolationI
Log::write(LOG, rec); Log::write(LOG, rec);
} }
hook Analyzer::disabling_analyzer(c: connection, atype: AllAnalyzers::Tag, aid: count) &priority=-1000 &group="Analyzer::Logging::include_disabling" hook Analyzer::disabling_analyzer(c: connection, atype: AllAnalyzers::Tag, aid: count) &priority=-1000 &group="Analyzer::DebugLogging::include_disabling"
{ {
if ( atype in ignore_analyzers ) if ( atype in ignore_analyzers )
return; return;