Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

logging: Support rotation_postprocessor_command_env

Browse source 
This new table provides a mechanism to add environment variables to the
postprocessor execution. Use case is from ZeekControl to inject a suffix
to be used when running with multiple logger.
This commit is contained in:
Arne Welzel 2023-04-06 19:28:06 +02:00
parent 75245bd365
commit d89f16dfc9
5 changed files with 88 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

32
testing/btest/scripts/base/frameworks/logging/rotate-pp-env.zeek Normal file
View file

@ -0,0 +1,32 @@
# @TEST-DOC: Using a custom environment for the postprocessor command.
# @TEST-EXEC: ZEEK_ARG_EXTERNAL=external zeek -b -r ${TRACES}/rotation.trace %INPUT >out 2>&1
# @TEST-EXEC: btest-diff out
module Test;
export {
redef enum Log::ID += { LOG };
type Log: record {
t: time;
id: conn_id;
} &log;
}
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "env | grep ZEEK_ARG | sort; true ";
redef Log::default_rotation_postprocessor_cmd_env += {
["REDEF"] = "redef",
};
event zeek_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::default_rotation_postprocessor_cmd_env["INIT"] = "zeek_init";
}
event new_connection(c: connection)
{
Log::write(Test::LOG, [$t=network_time(), $id=c$id]);
}