diff --git a/scripts/base/frameworks/logging/main.zeek b/scripts/base/frameworks/logging/main.zeek index b85a29c3ab..0a55d25a38 100644 --- a/scripts/base/frameworks/logging/main.zeek +++ b/scripts/base/frameworks/logging/main.zeek @@ -860,32 +860,11 @@ function Log::rotation_format_func(ri: Log::RotationFmtInfo): Log::RotationPath return rval; } -# Keep maximum stream delay and last queue sizes around. -global max_stream_delay_intervals: table[ID] of interval; -global max_stream_delay_queue_sizes: table[ID] of count; - function create_stream(id: ID, stream: Stream) : bool { if ( ! __create_stream(id, stream) ) return F; - # Restore max value of any prior set_max_delay_interval(). - if ( id in max_stream_delay_intervals && - max_stream_delay_intervals[id] > stream$max_delay_interval ) - stream$max_delay_interval = max_stream_delay_intervals[id]; - else - max_stream_delay_intervals[id] = stream$max_delay_interval; - - # Restore the previous queue size. - if ( id in max_stream_delay_queue_sizes && - max_stream_delay_queue_sizes[id] != stream$max_delay_queue_size ) - stream$max_delay_queue_size = max_stream_delay_queue_sizes[id]; - else - max_stream_delay_queue_sizes[id] = stream$max_delay_queue_size; - - Log::__set_max_delay_interval(id, stream$max_delay_interval); - Log::__set_max_delay_queue_size(id, stream$max_delay_queue_size); - active_streams[id] = stream; all_streams[id] = stream; @@ -1059,7 +1038,6 @@ function set_max_delay_interval(id: Log::ID, max_delay: interval): bool if ( ! Log::__set_max_delay_interval(id, max_delay) ) return F; - max_stream_delay_intervals[id] = max_delay; all_streams[id]$max_delay_interval = max_delay; return T; @@ -1070,13 +1048,9 @@ function set_max_delay_queue_size(id: Log::ID, max_size: count): bool if ( id !in all_streams ) return F; - if ( all_streams[id]$max_delay_queue_size == max_size ) - return T; - if ( ! Log::__set_max_delay_queue_size(id, max_size) ) return F; - max_stream_delay_queue_sizes[id] = max_size; all_streams[id]$max_delay_queue_size = max_size; return T; diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index 15e134889e..d2010f783e 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -592,6 +592,8 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval) { streams[idx]->event = event ? event_registry->Lookup(event->Name()) : nullptr; streams[idx]->policy = policy; streams[idx]->columns = columns->Ref()->AsRecordType(); + streams[idx]->max_delay_interval = sval->GetField("max_delay_interval")->AsTime(); + streams[idx]->max_delay_queue_size = sval->GetField("max_delay_queue_size")->AsCount(); streams[idx]->enable_remote = id::find_val("Log::enable_remote_logging")->AsBool(); diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 53b9095773..5bebc930f3 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -62,30 +62,6 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Tunnel::LOG, [columns=Tunnel::Info, ev=, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) -> 0.000000 MetaHookPost CallFunction(Log::__enable_stream, , (Analyzer::Logging::LOG)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Analyzer::Logging::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Broker::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Cluster::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Config::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Conn::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (DPD::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Files::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (HTTP::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Notice::ALARM_LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Notice::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Tunnel::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, , (Weird::LOG, 200.0 msecs)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Analyzer::Logging::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Broker::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Cluster::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Config::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Conn::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (DPD::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Files::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (HTTP::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Notice::ALARM_LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Notice::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Tunnel::LOG, 1000)) -> -0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, , (Weird::LOG, 1000)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Analyzer::Logging::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) -> @@ -1004,30 +980,6 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Tunnel::LOG, [columns=Tunnel::Info, ev=, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) 0.000000 MetaHookPre CallFunction(Log::__enable_stream, , (Analyzer::Logging::LOG)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Analyzer::Logging::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Broker::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Cluster::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Config::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Conn::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (DPD::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Files::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (HTTP::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Notice::ALARM_LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Notice::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Tunnel::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, , (Weird::LOG, 200.0 msecs)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Analyzer::Logging::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Broker::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Cluster::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Config::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Conn::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (DPD::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Files::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (HTTP::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Notice::ALARM_LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Notice::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Tunnel::LOG, 1000)) -0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, , (Weird::LOG, 1000)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Analyzer::Logging::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG)) @@ -1945,30 +1897,6 @@ 0.000000 | HookCallFunction Log::__create_stream(Tunnel::LOG, [columns=Tunnel::Info, ev=, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000]) 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000]) 0.000000 | HookCallFunction Log::__enable_stream(Analyzer::Logging::LOG) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Analyzer::Logging::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Broker::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Cluster::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Config::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Conn::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(DPD::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Files::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(HTTP::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Notice::ALARM_LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Notice::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Tunnel::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_interval(Weird::LOG, 200.0 msecs) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Analyzer::Logging::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Broker::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Cluster::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Config::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Conn::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(DPD::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Files::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(HTTP::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Notice::ALARM_LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Notice::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Tunnel::LOG, 1000) -0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Weird::LOG, 1000) 0.000000 | HookCallFunction Log::add_default_filter(Analyzer::Logging::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)