From d40bb6e85f334843f53489afd71e761f6125eeeb Mon Sep 17 00:00:00 2001 From: Christian Kreibich Date: Thu, 12 May 2022 22:50:18 -0700 Subject: [PATCH] Management framework: simplify agent and controller stdout/stderr files Moving to a model in which every Zeek process runs out of its own working directory simplifies the handling of those files. --- scripts/policy/frameworks/management/agent/boot.zeek | 8 ++++---- .../policy/frameworks/management/agent/config.zeek | 12 +++++------- .../frameworks/management/controller/config.zeek | 12 ++++++------ 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/scripts/policy/frameworks/management/agent/boot.zeek b/scripts/policy/frameworks/management/agent/boot.zeek index 663614ecf0..5863b0517d 100644 --- a/scripts/policy/frameworks/management/agent/boot.zeek +++ b/scripts/policy/frameworks/management/agent/boot.zeek @@ -23,10 +23,10 @@ event zeek_init() if ( Management::Agent::directory != "" ) sn$directory = Management::Agent::directory; - if ( Management::Agent::stdout_file_suffix != "" ) - sn$stdout_file = epi$id + "." + Management::Agent::stdout_file_suffix; - if ( Management::Agent::stderr_file_suffix != "" ) - sn$stderr_file = epi$id + "." + Management::Agent::stderr_file_suffix; + if ( Management::Agent::stdout_file != "" ) + sn$stdout_file = Management::Agent::stdout_file; + if ( Management::Agent::stderr_file != "" ) + sn$stderr_file = Management::Agent::stderr_file; # This helps identify Management framework nodes reliably. sn$env["ZEEK_MANAGEMENT_NODE"] = "AGENT"; diff --git a/scripts/policy/frameworks/management/agent/config.zeek b/scripts/policy/frameworks/management/agent/config.zeek index 51a36343b9..6a6dda7c6c 100644 --- a/scripts/policy/frameworks/management/agent/config.zeek +++ b/scripts/policy/frameworks/management/agent/config.zeek @@ -14,18 +14,16 @@ export { ## Agent stdout log configuration. If the string is non-empty, Zeek will ## produce a free-form log (i.e., not one governed by Zeek's logging - ## framework) in Zeek's working directory. The final log's name is - ## ".", where the name is taken from :zeek:see:`Management::Agent::get_name`, - ## and the suffix is defined by the following variable. If left empty, - ## no such log results. + ## framework) in the agent's working directory. If left empty, no such + ## log results. ## ## Note that the agent also establishes a "proper" Zeek log via the ## :zeek:see:`Management::Log` module. - const stdout_file_suffix = "agent.stdout" &redef; + const stdout_file = "stdout" &redef; - ## Agent stderr log configuration. Like :zeek:see:`Management::Agent::stdout_file_suffix`, + ## Agent stderr log configuration. Like :zeek:see:`Management::Agent::stdout_file`, ## but for the stderr stream. - const stderr_file_suffix = "agent.stderr" &redef; + const stderr_file = "stderr" &redef; ## The network address the agent listens on. This only takes effect if ## the agent isn't configured to connect to the controller (see diff --git a/scripts/policy/frameworks/management/controller/config.zeek b/scripts/policy/frameworks/management/controller/config.zeek index f8ac86f0ec..f39d26ba15 100644 --- a/scripts/policy/frameworks/management/controller/config.zeek +++ b/scripts/policy/frameworks/management/controller/config.zeek @@ -12,18 +12,18 @@ export { ## "controller-". const name = getenv("ZEEK_CONTROLLER_NAME") &redef; - ## The controller's stdout log name. If the string is non-empty, Zeek will - ## produce a free-form log (i.e., not one governed by Zeek's logging - ## framework) in Zeek's working directory. If left empty, no such log - ## results. + ## The controller's stdout log name. If the string is non-empty, Zeek + ## will produce a free-form log (i.e., not one governed by Zeek's + ## logging framework) in the controller's working directory. If left + ## empty, no such log results. ## ## Note that the controller also establishes a "proper" Zeek log via the ## :zeek:see:`Management::Log` module. - const stdout_file = "controller.stdout" &redef; + const stdout_file = "stdout" &redef; ## The controller's stderr log name. Like :zeek:see:`Management::Controller::stdout_file`, ## but for the stderr stream. - const stderr_file = "controller.stderr" &redef; + const stderr_file = "stderr" &redef; ## The network address the controller listens on. By default this uses ## the value of the ZEEK_CONTROLLER_ADDR environment variable, but you