Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/master' into topic/seth/notice-suppression

Browse source
This commit is contained in:
Seth Hall 2011-09-21 02:26:19 -04:00
commit d18fdef2d4
548 changed files with 523 additions and 29934 deletions
Download patch file Download diff file Expand all files Collapse all files

26
testing/btest/scripts/base/frameworks/logging/path-func-column-demote.bro Normal file
View file

@ -0,0 +1,26 @@
# @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT
# @TEST-EXEC: btest-diff local.log
# @TEST-EXEC: btest-diff remote.log
#
# The record value passed into the path_func should be allowed to contain a
# subset of the fields in the stream's columns.
@load base/utils/site
@load base/protocols/conn
@load base/frameworks/notice
redef Site::local_nets = {141.142.0.0/16};
function split_log(id: Log::ID, path: string, rec: record {id:conn_id;}): string
{
return Site::is_local_addr(rec$id$orig_h) ? "local" : "remote";
}
event bro_init()
{
# Add a new filter to the Conn::LOG stream that logs only
# timestamp and originator address.
local filter: Log::Filter = [$name="dst-only", $path_func=split_log,
$include=set("ts", "id.orig_h")];
Log::add_filter(Conn::LOG, filter);
}

7
testing/btest/scripts/base/frameworks/logging/rotate-custom.bro
View file

@ -26,15 +26,10 @@ function custom_rotate(info: Log::RotationInfo) : bool
return T;
}
redef Log::rotation_control += {
[Log::WRITER_ASCII, "test2"] = [$interv=30mins, $postprocessor=custom_rotate]
};
event bro_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::add_filter(Test::LOG, [$name="2nd", $path="test2"]);
Log::add_filter(Test::LOG, [$name="2nd", $path="test2", $interv=30mins, $postprocessor=custom_rotate]);
}
event new_connection(c: connection)