Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

analyzer: Cap analyzer violations at 1000 per analyzer instance

Browse source
This commit is contained in:
Arne Welzel 2022-10-12 17:35:52 +02:00 • committed by Tim Wojtulewicz
parent 557ffe7bbc
commit c58cdf407a
5 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/init-bare.zeek
View file

@ -2312,6 +2312,19 @@ type AnalyzerViolationInfo: record {
data: string &optional;
};
## The maximum number of analyzer violations the core generates before
## suppressing them for a given analyzer instance. A weird providing
## information about the analyzer and connection is generated once the
## limit is reached.
##
## An analyzer generating this many violations is unlikely parsing
## the right protocol or potentially buggy.
##
## See also :zeek:see:`DPD::max_violations` which controls disabling
## analyzers through script logic after a certain number of violations
## was observed.
const max_analyzer_violations = 1000 &redef;
module NFS3;