mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
Add gzip log writing to the ascii writer.
This feature can be enabled globally for all logs by setting LogAscii::gzip_level to a value greater than 0. This feature can be enabled on a per-log basis by setting gzip-level in $confic to a value greater than 0.
This commit is contained in:
parent
2c2c9c9052
commit
c868a19a28
7 changed files with 191 additions and 8 deletions
75
testing/btest/scripts/base/frameworks/logging/ascii-gz.bro
Normal file
75
testing/btest/scripts/base/frameworks/logging/ascii-gz.bro
Normal file
|
@ -0,0 +1,75 @@
|
|||
#
|
||||
# @TEST-EXEC: bro -b %INPUT
|
||||
# @TEST-EXEC: gunzip ssh.log.gz
|
||||
# @TEST-EXEC: btest-diff ssh.log
|
||||
# @TEST-EXEC: btest-diff ssh-uncompressed.log
|
||||
#
|
||||
# Testing all possible types.
|
||||
|
||||
redef LogAscii::gzip_level = 9;
|
||||
|
||||
module SSH;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { LOG };
|
||||
|
||||
type Log: record {
|
||||
b: bool;
|
||||
i: int;
|
||||
e: Log::ID;
|
||||
c: count;
|
||||
p: port;
|
||||
sn: subnet;
|
||||
a: addr;
|
||||
d: double;
|
||||
t: time;
|
||||
iv: interval;
|
||||
s: string;
|
||||
sc: set[count];
|
||||
ss: set[string];
|
||||
se: set[string];
|
||||
vc: vector of count;
|
||||
ve: vector of string;
|
||||
f: function(i: count) : string;
|
||||
} &log;
|
||||
}
|
||||
|
||||
function foo(i : count) : string
|
||||
{
|
||||
if ( i > 0 )
|
||||
return "Foo";
|
||||
else
|
||||
return "Bar";
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Log::create_stream(SSH::LOG, [$columns=Log]);
|
||||
local filter = Log::Filter($name="ssh-uncompressed", $path="ssh-uncompressed",
|
||||
$config = table(["gzip_level"] = "0"));
|
||||
Log::add_filter(SSH::LOG, filter);
|
||||
|
||||
local empty_set: set[string];
|
||||
local empty_vector: vector of string;
|
||||
|
||||
Log::write(SSH::LOG, [
|
||||
$b=T,
|
||||
$i=-42,
|
||||
$e=SSH::LOG,
|
||||
$c=21,
|
||||
$p=123/tcp,
|
||||
$sn=10.0.0.1/24,
|
||||
$a=1.2.3.4,
|
||||
$d=3.14,
|
||||
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "2008-07-09T16:13:30Z") + 0.543210 secs),
|
||||
$iv=100secs,
|
||||
$s="hurz",
|
||||
$sc=set(1,2,3,4),
|
||||
$ss=set("AA", "BB", "CC"),
|
||||
$se=empty_set,
|
||||
$vc=vector(10, 20, 30),
|
||||
$ve=empty_vector,
|
||||
$f=foo
|
||||
]);
|
||||
}
|
||||
|
Loading…
Add table
Add a link
Reference in a new issue