Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

add seeking functionality to raw reader.

Browse source 
one can now add an option "offset" to the config map. Positive offsets
are interpreted to be from the beginning of the file, negative from the
end of the file (-1 is end of file).

Only works for raw reader in streaming or manual mode. Does not work
with executables.

Addresses BIT-985
This commit is contained in:
Johanna Amann 2015-04-17 11:16:31 -07:00
parent ee5f87c634
commit cbba73ab12
4 changed files with 75 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

45
testing/btest/scripts/base/frameworks/input/raw/offset.bro Normal file
View file

@ -0,0 +1,45 @@
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
# @TEST-EXEC: btest-bg-wait 5
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
@TEST-START-FILE input.log
sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
@TEST-END-FILE
redef exit_only_after_terminate = T;
global outfile: file;
global try: count;
module A;
type Val: record {
s: string;
};
event line(description: Input::EventDescription, tpe: Input::Event, s: string)
{
print outfile, s;
try = try + 1;
if ( try == 2 )
{
Input::remove("input");
close(outfile);
terminate();
}
}
event bro_init()
{
try = 0;
outfile = open("../out");
local config_strings: table[string] of string = {
["offset"] = "2",
};
local config_strings_two: table[string] of string = {
["offset"] = "-3", # 2 characters before end, last char is newline.
};
Input::add_event([$source="../input.log", $config=config_strings, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input", $fields=Val, $ev=line, $want_record=F]);
Input::add_event([$source="../input.log", $config=config_strings_two, $reader=Input::READER_RAW, $mode=Input::STREAM, $name="input2", $fields=Val, $ev=line, $want_record=F]);
}