mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 09:38:19 +00:00
Merge remote-tracking branch 'origin/master' into topic/seth/notice-suppression
This commit is contained in:
Seth Hall
commit
d18fdef2d4
548 changed files with 523 additions and 29934 deletions
|
|
@ -1,11 +1,11 @@
|
|||
##! This is a utility script that sends the current values of all &redef'able
|
||||
##! This is a utility script that sends the current values of all &redef'able
|
||||
##! consts to a remote Bro then sends the :bro:id:`configuration_update` event
|
||||
##! and terminates processing.
|
||||
##!
|
||||
##! Intended to be used from the command line like this when starting a controller::
|
||||
##!
|
||||
##! bro <scripts> frameworks/control/controller Control::host=<host_addr> Control::port=<host_port> Control::cmd=<command> [Control::arg=<arg>]
|
||||
##!
|
||||
##!
|
||||
##! A controllee only needs to load the controllee script in addition
|
||||
##! to the specific analysis scripts desired. It may also need a node
|
||||
##! configured as a controller node in the communications nodes configuration::
|
||||
|
|
@ -22,52 +22,50 @@ module Control;
|
|||
export {
|
||||
## This is the address of the host that will be controlled.
|
||||
const host = 0.0.0.0 &redef;
|
||||
|
||||
|
||||
## This is the port of the host that will be controlled.
|
||||
const host_port = 0/tcp &redef;
|
||||
|
||||
## This is the command that is being done. It's typically set on the
|
||||
## This is the command that is being done. It's typically set on the
|
||||
## command line and influences whether this instance starts up as a
|
||||
## controller or controllee.
|
||||
const cmd = "" &redef;
|
||||
|
||||
|
||||
## This can be used by commands that take an argument.
|
||||
const arg = "" &redef;
|
||||
|
||||
|
||||
const controller_events = /Control::.*_request/ &redef;
|
||||
const controllee_events = /Control::.*_response/ &redef;
|
||||
|
||||
## These are the commands that can be given on the command line for
|
||||
## remote control.
|
||||
const commands: set[string] = {
|
||||
const commands: set[string] = {
|
||||
"id_value",
|
||||
"peer_status",
|
||||
"net_stats",
|
||||
"configuration_update",
|
||||
"shutdown",
|
||||
};
|
||||
|
||||
|
||||
## Variable IDs that are to be ignored by the update process.
|
||||
const ignore_ids: set[string] = {
|
||||
# FIXME: Bro crashes if it tries to send this ID.
|
||||
"Log::rotation_control",
|
||||
};
|
||||
|
||||
|
||||
## Event for requesting the value of an ID (a variable).
|
||||
global id_value_request: event(id: string);
|
||||
## Event for returning the value of an ID after an :bro:id:`id_request` event.
|
||||
global id_value_response: event(id: string, val: string);
|
||||
|
||||
|
||||
## Requests the current communication status.
|
||||
global peer_status_request: event();
|
||||
## Returns the current communication status.
|
||||
global peer_status_response: event(s: string);
|
||||
|
||||
|
||||
## Requests the current net_stats.
|
||||
global net_stats_request: event();
|
||||
## Returns the current net_stats.
|
||||
global net_stats_response: event(s: string);
|
||||
|
||||
|
||||
## Inform the remote Bro instance that it's configuration may have been updated.
|
||||
global configuration_update_request: event();
|
||||
## This event is a wrapper and alias for the :bro:id:`configuration_update_request` event.
|
||||
|
|
@ -75,7 +73,7 @@ export {
|
|||
global configuration_update: event();
|
||||
## Message in response to a configuration update request.
|
||||
global configuration_update_response: event();
|
||||
|
||||
|
||||
## Requests that the Bro instance begins shutting down.
|
||||
global shutdown_request: event();
|
||||
## Message in response to a shutdown request.
|
||||
|
|
|
|||
|
|
@ -32,14 +32,41 @@ export {
|
|||
## to derive a name.
|
||||
##
|
||||
## id: The log stream.
|
||||
## path: A suggested path value, which may be either the filter's ``path``
|
||||
## if defined or a fall-back generated internally.
|
||||
## path: A suggested path value, which may be either the filter's
|
||||
## ``path`` if defined, else a previous result from the function.
|
||||
## If no ``path`` is defined for the filter, then the first call
|
||||
## to the function will contain an empty string.
|
||||
## rec: An instance of the streams's ``columns`` type with its
|
||||
## fields set to the values to logged.
|
||||
##
|
||||
## Returns: The path to be used for the filter.
|
||||
global default_path_func: function(id: ID, path: string, rec: any) : string &redef;
|
||||
|
||||
# Log rotation support.
|
||||
|
||||
## Information passed into rotation callback functions.
|
||||
type RotationInfo: record {
|
||||
writer: Writer; ##< Writer.
|
||||
fname: string; ##< Full name of the rotated file.
|
||||
path: string; ##< Original path value.
|
||||
open: time; ##< Time when opened.
|
||||
close: time; ##< Time when closed.
|
||||
terminating: bool; ##< True if rotation occured due to Bro shutting down.
|
||||
};
|
||||
|
||||
## Default rotation interval. Zero disables rotation.
|
||||
const default_rotation_interval = 0secs &redef;
|
||||
|
||||
## Default naming format for timestamps embedded into filenames. Uses a strftime() style.
|
||||
const default_rotation_date_format = "%Y-%m-%d-%H-%M-%S" &redef;
|
||||
|
||||
## Default shell command to run on rotated files. Empty for none.
|
||||
const default_rotation_postprocessor_cmd = "" &redef;
|
||||
|
||||
## Specifies the default postprocessor function per writer type. Entries in this
|
||||
## table are initialized by each writer type.
|
||||
const default_rotation_postprocessors: table[Writer] of function(info: RotationInfo) : bool &redef;
|
||||
|
||||
## Filter customizing logging.
|
||||
type Filter: record {
|
||||
## Descriptive name to reference this filter.
|
||||
|
|
@ -75,8 +102,10 @@ export {
|
|||
## connection ...
|
||||
##
|
||||
## id: The log stream.
|
||||
## path: A suggested path value, which may be either the filter's ``path``
|
||||
## if defined or a fall-back generated internally.
|
||||
## path: A suggested path value, which may be either the filter's
|
||||
## ``path`` if defined, else a previous result from the function.
|
||||
## If no ``path`` is defined for the filter, then the first call
|
||||
## to the function will contain an empty string.
|
||||
## rec: An instance of the streams's ``columns`` type with its
|
||||
## fields set to the values to logged.
|
||||
##
|
||||
|
|
@ -96,47 +125,15 @@ export {
|
|||
|
||||
## If true, entries are passed on to remote peers.
|
||||
log_remote: bool &default=enable_remote_logging;
|
||||
};
|
||||
|
||||
# Log rotation support.
|
||||
|
||||
## Information passed into rotation callback functions.
|
||||
type RotationInfo: record {
|
||||
writer: Writer; ##< Writer.
|
||||
fname: string; ##< Full name of the rotated file.
|
||||
path: string; ##< Original path value.
|
||||
open: time; ##< Time when opened.
|
||||
close: time; ##< Time when closed.
|
||||
terminating: bool; ##< True if rotation occured due to Bro shutting down.
|
||||
};
|
||||
|
||||
## Default rotation interval. Zero disables rotation.
|
||||
const default_rotation_interval = 0secs &redef;
|
||||
|
||||
## Default naming format for timestamps embedded into filenames. Uses a strftime() style.
|
||||
const default_rotation_date_format = "%Y-%m-%d-%H-%M-%S" &redef;
|
||||
|
||||
## Default shell command to run on rotated files. Empty for none.
|
||||
const default_rotation_postprocessor_cmd = "" &redef;
|
||||
|
||||
## Specifies the default postprocessor function per writer type. Entries in this
|
||||
## table are initialized by each writer type.
|
||||
const default_rotation_postprocessors: table[Writer] of function(info: RotationInfo) : bool &redef;
|
||||
|
||||
## Type for controlling file rotation.
|
||||
type RotationControl: record {
|
||||
## Rotation interval.
|
||||
interv: interval &default=default_rotation_interval;
|
||||
## Callback function to trigger for rotated files. If not set, the default
|
||||
## comes out of default_rotation_postprocessors.
|
||||
|
||||
## Callback function to trigger for rotated files. If not set,
|
||||
## the default comes out of default_rotation_postprocessors.
|
||||
postprocessor: function(info: RotationInfo) : bool &optional;
|
||||
};
|
||||
|
||||
## Specifies rotation parameters per ``(id, path)`` tuple.
|
||||
## If a pair is not found in this table, default values defined in
|
||||
## ``RotationControl`` are used.
|
||||
const rotation_control: table[Writer, string] of RotationControl &default=[] &redef;
|
||||
|
||||
## Sentinel value for indicating that a filter was not found when looked up.
|
||||
const no_filter: Filter = [$name="<not found>"]; # Sentinel.
|
||||
|
||||
|
|
@ -177,10 +174,9 @@ function default_path_func(id: ID, path: string, rec: any) : string
|
|||
local parts = split1(id_str, /::/);
|
||||
if ( |parts| == 2 )
|
||||
{
|
||||
# TODO: the core shouldn't be suggesting paths anymore. Only
|
||||
# statically defined paths should be sent into here. This
|
||||
# is only to cope with the core generated paths.
|
||||
if ( to_lower(parts[2]) != path )
|
||||
# The suggested path value is a previous result of this function
|
||||
# or a filter path explicitly set by the user, so continue using it.
|
||||
if ( path != "" )
|
||||
return path;
|
||||
|
||||
# Example: Notice::LOG -> "notice"
|
||||
|
|
|
|||
|
|
@ -289,18 +289,6 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool
|
|||
return T;
|
||||
}
|
||||
|
||||
# This extra export section here is just because this redefinition should
|
||||
# be documented as part of the "public API" of this script, but the redef
|
||||
# needs to occur after the postprocessor function implementation.
|
||||
export {
|
||||
## By default, an ASCII version of the the alarm log is emailed daily to any
|
||||
## configured :bro:id:`Notice::mail_dest` if not operating on trace files.
|
||||
redef Log::rotation_control += {
|
||||
[Log::WRITER_ASCII, "alarm-mail"] =
|
||||
[$interv=24hrs, $postprocessor=log_mailing_postprocessor]
|
||||
};
|
||||
}
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice]);
|
||||
|
|
@ -311,9 +299,9 @@ event bro_init() &priority=5
|
|||
# Make sure that this alarm log is also output as text so that it can
|
||||
# be packaged up and emailed later.
|
||||
if ( ! reading_traces() && mail_dest != "" )
|
||||
Log::add_filter(Notice::ALARM_LOG, [$name="alarm-mail",
|
||||
$path="alarm-mail",
|
||||
$writer=Log::WRITER_ASCII]);
|
||||
Log::add_filter(Notice::ALARM_LOG,
|
||||
[$name="alarm-mail", $path="alarm-mail", $writer=Log::WRITER_ASCII,
|
||||
$interv=24hrs, $postprocessor=log_mailing_postprocessor]);
|
||||
}
|
||||
|
||||
# TODO: fix this.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue