diff --git a/CHANGES b/CHANGES index 5f40755c6c..9b1a87e628 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +3.2.0-dev.447 | 2020-04-29 15:55:03 -0700 + + * GH-713: Fixed misc/stats.zeek skipping a log entry on termination (Brittany Donowho) + 3.2.0-dev.445 | 2020-04-29 15:25:03 -0700 * Add warning message for unknown Broker statuses (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 0d2171ff80..65ed375fdd 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.2.0-dev.445 +3.2.0-dev.447 diff --git a/scripts/policy/misc/stats.zeek b/scripts/policy/misc/stats.zeek index df092ea064..bb17c2f458 100644 --- a/scripts/policy/misc/stats.zeek +++ b/scripts/policy/misc/stats.zeek @@ -99,11 +99,6 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr local fs = get_file_analysis_stats(); local ds = get_dns_stats(); - if ( zeek_is_terminating() ) - # No more stats will be written or scheduled when Zeek is - # shutting down. - return; - local info: Info = [$ts=nettime, $peer=peer_description, $mem=ps$mem/1048576, @@ -146,6 +141,12 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr } Log::write(Stats::LOG, info); + + if ( zeek_is_terminating() ) + # No more stats will be written or scheduled when Zeek is + # shutting down. + return; + schedule report_interval { check_stats(nettime, ns, cs, ps, es, rs, ts, fs, ds) }; } diff --git a/testing/btest/Baseline/scripts.policy.misc.stats/stats.log b/testing/btest/Baseline/scripts.policy.misc.stats/stats.log new file mode 100644 index 0000000000..8249de3d01 --- /dev/null +++ b/testing/btest/Baseline/scripts.policy.misc.stats/stats.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path stats +#open 2020-04-29-22-53-33 +#fields pkts_proc +#types count +1 +135 +#close 2020-04-29-22-53-33 diff --git a/testing/btest/scripts/policy/misc/stats.zeek b/testing/btest/scripts/policy/misc/stats.zeek index 3af977ffcd..ffceead050 100644 --- a/testing/btest/scripts/policy/misc/stats.zeek +++ b/testing/btest/scripts/policy/misc/stats.zeek @@ -1,4 +1,5 @@ # @TEST-EXEC: zeek -r $TRACES/wikipedia.trace %INPUT +# @TEST-EXEC: btest-diff stats.log @load policy/misc/stats @@ -8,3 +9,11 @@ event load_sample(samples: load_sample_info, CPU: interval, dmem: int) # should still exist to cover potential memory leaks. print CPU; } + +event zeek_init() + { + # Various fields will be unstable for use in baseline, so use one that is. + local filter: Log::Filter = [$name="pkt-stats", $include=set("pkts_proc")]; + Log::remove_filter(Stats::LOG, "default"); + Log::add_filter(Stats::LOG, filter); + }