Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Copy docs into Zeek repo directly

Browse source 
This is based on commit 2731def9159247e6da8a3191783c89683363689c from the
zeek-docs repo.
This commit is contained in:
Tim Wojtulewicz 2025-09-15 15:52:18 -07:00
parent 83f1e74643
commit ded98cd373
1074 changed files with 169319 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
doc/scripts/base/files/extract/__load__.zeek.rst Normal file
View file

@ -0,0 +1,14 @@
:tocdepth: 3
base/files/extract/__load__.zeek
================================
:Imports: :doc:`base/files/extract/main.zeek </scripts/base/files/extract/main.zeek>`
Summary
~~~~~~~
Detailed Interface
~~~~~~~~~~~~~~~~~~

13
doc/scripts/base/files/extract/index.rst Normal file
View file

@ -0,0 +1,13 @@
:orphan:
Package: base/files/extract
===========================
Support for extracting files with the file analysis framework.
:doc:`/scripts/base/files/extract/__load__.zeek`
:doc:`/scripts/base/files/extract/main.zeek`

127
doc/scripts/base/files/extract/main.zeek.rst Normal file
View file

@ -0,0 +1,127 @@
:tocdepth: 3
base/files/extract/main.zeek
============================
.. zeek:namespace:: FileExtract
:Namespace: FileExtract
:Imports: :doc:`base/frameworks/files </scripts/base/frameworks/files/index>`, :doc:`base/utils/paths.zeek </scripts/base/utils/paths.zeek>`
Summary
~~~~~~~
Runtime Options
###############
============================================================================================= ================================================================
:zeek:id:`FileExtract::default_limit`: :zeek:type:`count` :zeek:attr:`&redef` The default max size for extracted files (they won't exceed this
number of bytes).
:zeek:id:`FileExtract::default_limit_includes_missing`: :zeek:type:`bool` :zeek:attr:`&redef` This setting configures if the file extract limit is inclusive
of missing bytes.
============================================================================================= ================================================================
Redefinable Options
###################
======================================================================= ========================================
:zeek:id:`FileExtract::prefix`: :zeek:type:`string` :zeek:attr:`&redef` The prefix where files are extracted to.
======================================================================= ========================================
Redefinitions
#############
========================================================================= ==========================================================================================================================================================
:zeek:type:`Files::AnalyzerArgs`: :zeek:type:`record` :zeek:attr:`&redef`
:New Fields: :zeek:type:`Files::AnalyzerArgs`
extract_filename: :zeek:type:`string` :zeek:attr:`&optional`
The local filename to which to write an extracted file.
extract_limit: :zeek:type:`count` :zeek:attr:`&default` = :zeek:see:`FileExtract::default_limit` :zeek:attr:`&optional`
The maximum allowed file size in bytes of *extract_filename*.
extract_limit_includes_missing: :zeek:type:`bool` :zeek:attr:`&default` = :zeek:see:`FileExtract::default_limit_includes_missing` :zeek:attr:`&optional`
By default, missing bytes in files count towards the extract file size.
:zeek:type:`Files::Info`: :zeek:type:`record` :zeek:attr:`&redef`
:New Fields: :zeek:type:`Files::Info`
extracted: :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`
Local filename of extracted file.
extracted_cutoff: :zeek:type:`bool` :zeek:attr:`&optional` :zeek:attr:`&log`
Set to true if the file being extracted was cut off
so the whole file was not logged.
extracted_size: :zeek:type:`count` :zeek:attr:`&optional` :zeek:attr:`&log`
The number of bytes extracted to disk.
========================================================================= ==========================================================================================================================================================
Functions
#########
======================================================== =============================================
:zeek:id:`FileExtract::set_limit`: :zeek:type:`function` Sets the maximum allowed extracted file size.
======================================================== =============================================
Detailed Interface
~~~~~~~~~~~~~~~~~~
Runtime Options
###############
.. zeek:id:: FileExtract::default_limit
:source-code: base/files/extract/main.zeek 12 12
:Type: :zeek:type:`count`
:Attributes: :zeek:attr:`&redef`
:Default: ``104857600``
The default max size for extracted files (they won't exceed this
number of bytes). A value of zero means unlimited. Defaults to 100MB.
.. zeek:id:: FileExtract::default_limit_includes_missing
:source-code: base/files/extract/main.zeek 21 21
:Type: :zeek:type:`bool`
:Attributes: :zeek:attr:`&redef`
:Default: ``T``
This setting configures if the file extract limit is inclusive
of missing bytes. By default, missing bytes do count towards the
limit.
Setting this option to false changes this behavior so that missing
bytes no longer count towards these limits. Files with
missing bytes are created as sparse files on disk. Their apparent size
can exceed this file size limit.
Redefinable Options
###################
.. zeek:id:: FileExtract::prefix
:source-code: base/files/extract/main.zeek 8 8
:Type: :zeek:type:`string`
:Attributes: :zeek:attr:`&redef`
:Default: ``"./extract_files/"``
The prefix where files are extracted to.
Functions
#########
.. zeek:id:: FileExtract::set_limit
:source-code: base/files/extract/main.zeek 72 75
:Type: :zeek:type:`function` (f: :zeek:type:`fa_file`, args: :zeek:type:`Files::AnalyzerArgs`, n: :zeek:type:`count`) : :zeek:type:`bool`
Sets the maximum allowed extracted file size.
:param f: A file that's being extracted.
:param args: Arguments that identify a file extraction analyzer.
:param n: Allowed number of bytes to be extracted.
:returns: false if a file extraction analyzer wasn't active for
the file, else true.