Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Adding a few options to the ASCII writer.

Browse source 
module LogAscii;

export {
	# Output everything to stdout rather than into files. This is primarily
	# for testing purposes.
	const output_to_stdout = F &redef;

	# The separator between fields.
	const separator = "\t" &redef;

	# True to include a header line with column names.
	const include_header = T &redef;
}
This commit is contained in:
Robin Sommer 2011-03-08 21:43:52 -08:00
parent 26eab74ecc
commit c6d20dbfdf
9 changed files with 101 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

5
testing/btest/Baseline/logging.ascii-options/output Normal file
View file

@ -0,0 +1,5 @@
1299649281.43936|1.2.3.4|1234|2.3.4.5|80|success|unknown
1299649281.43936|1.2.3.4|1234|2.3.4.5|80|failure|US
1299649281.43936|1.2.3.4|1234|2.3.4.5|80|failure|UK
1299649281.43936|1.2.3.4|1234|2.3.4.5|80|success|BR
1299649281.43936|1.2.3.4|1234|2.3.4.5|80|failure|MX

35
testing/btest/logging/ascii-options.bro Normal file
View file

@ -0,0 +1,35 @@
#
# @TEST-EXEC: bro %INPUT >output
# @TEST-EXEC: btest-diff output
redef LogAscii::output_to_stdout = T;
redef LogAscii::separator = "|";
redef LogAscii::include_header = F;
module SSH;
export {
redef enum Log::ID += { SSH };
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
country: string &default="unknown";
};
}
event bro_init()
{
Log::create_stream(SSH, [$columns=Log]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
Log::write(SSH, [$t=network_time(), $id=cid, $status="success"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="UK"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="success", $country="BR"]);
Log::write(SSH, [$t=network_time(), $id=cid, $status="failure", $country="MX"]);
}