Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/seth/notice-suppression'

Browse source 
* origin/topic/seth/notice-suppression:
  Updated a notice related baseline and added a necessary @load line.
  Notice suppression clean up and notice/cluster integrtion fixes.
  Updates for notice suppression to use the &create_expire attribute
  Small, mostly cosmetic updates and fixing a test.
  Fix crash on exit (addresses #607).
  Duplicate notice suppression.

Closes #623.
This commit is contained in:
Robin Sommer 2011-09-22 19:20:19 -07:00
commit c9b9bab473
17 changed files with 323 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/frameworks/cluster/nodes/manager.bro
View file

@ -8,8 +8,6 @@
##! This is where the cluster manager sets it's specific settings for other
##! frameworks and in the core.
@load base/frameworks/notice
@prefixes += cluster-manager
# Load the script for local site configuration for the manager node.
@ -23,10 +21,3 @@ redef Log::default_rotation_postprocessor_cmd = "archive-log";
## We're processing essentially *only* remote events.
redef max_remote_events_processed = 10000;
# Reraise remote notices locally.
event Notice::notice(n: Notice::Info)
{
if ( is_remote_event() )
NOTICE(n);
}

14
scripts/base/frameworks/cluster/nodes/worker.bro
View file

@ -1,5 +1,3 @@
@load base/frameworks/notice
@prefixes += cluster-worker
# Load the script for local site configuration for the worker nodes.
@ -15,12 +13,8 @@ redef Log::enable_remote_logging = T;
redef Log::default_rotation_postprocessor_cmd = "delete-log";
## Record all packets into trace file.
# TODO: should we really be setting this to T?
##
## Note that this only indicates that *if* we are recording packets, we want all
## of them (rather than just those the core deems sufficiently important). Setting
## this does not turn recording on. Use '-w <trace>' for that.
redef record_all_packets = T;
# Workers need to have a filter for the notice log which doesn't
# do remote logging since we forward the notice event directly.
event bro_init()
{
Log::disable_stream(Notice::LOG);
}