Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

logging: Do not keep delay state persistent

Browse source 
If Log::remove_stream() and Log::create_stream() is called for a stream,
do not restore the previously used max delay or max queue size.
This commit is contained in:
Arne Welzel 2023-11-28 11:53:00 +01:00
parent fd096b1ce6
commit e3796894c6
3 changed files with 2 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/base/frameworks/logging/main.zeek
View file

@ -860,32 +860,11 @@ function Log::rotation_format_func(ri: Log::RotationFmtInfo): Log::RotationPath
return rval; return rval;
} }
# Keep maximum stream delay and last queue sizes around.
global max_stream_delay_intervals: table[ID] of interval;
global max_stream_delay_queue_sizes: table[ID] of count;
function create_stream(id: ID, stream: Stream) : bool function create_stream(id: ID, stream: Stream) : bool
{ {
if ( ! __create_stream(id, stream) ) if ( ! __create_stream(id, stream) )
return F; return F;
# Restore max value of any prior set_max_delay_interval().
if ( id in max_stream_delay_intervals &&
max_stream_delay_intervals[id] > stream$max_delay_interval )
stream$max_delay_interval = max_stream_delay_intervals[id];
else
max_stream_delay_intervals[id] = stream$max_delay_interval;
# Restore the previous queue size.
if ( id in max_stream_delay_queue_sizes &&
max_stream_delay_queue_sizes[id] != stream$max_delay_queue_size )
stream$max_delay_queue_size = max_stream_delay_queue_sizes[id];
else
max_stream_delay_queue_sizes[id] = stream$max_delay_queue_size;
Log::__set_max_delay_interval(id, stream$max_delay_interval);
Log::__set_max_delay_queue_size(id, stream$max_delay_queue_size);
active_streams[id] = stream; active_streams[id] = stream;
all_streams[id] = stream; all_streams[id] = stream;
@ -1059,7 +1038,6 @@ function set_max_delay_interval(id: Log::ID, max_delay: interval): bool
if ( ! Log::__set_max_delay_interval(id, max_delay) ) if ( ! Log::__set_max_delay_interval(id, max_delay) )
return F; return F;
max_stream_delay_intervals[id] = max_delay;
all_streams[id]$max_delay_interval = max_delay; all_streams[id]$max_delay_interval = max_delay;
return T; return T;
@ -1070,13 +1048,9 @@ function set_max_delay_queue_size(id: Log::ID, max_size: count): bool
if ( id !in all_streams ) if ( id !in all_streams )
return F; return F;
if ( all_streams[id]$max_delay_queue_size == max_size )
return T;
if ( ! Log::__set_max_delay_queue_size(id, max_size) ) if ( ! Log::__set_max_delay_queue_size(id, max_size) )
return F; return F;
max_stream_delay_queue_sizes[id] = max_size;
all_streams[id]$max_delay_queue_size = max_size; all_streams[id]$max_delay_queue_size = max_size;
return T; return T;

2
src/logging/Manager.cc
View file

@ -592,6 +592,8 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval) {
streams[idx]->event = event ? event_registry->Lookup(event->Name()) : nullptr; streams[idx]->event = event ? event_registry->Lookup(event->Name()) : nullptr;
streams[idx]->policy = policy; streams[idx]->policy = policy;
streams[idx]->columns = columns->Ref()->AsRecordType(); streams[idx]->columns = columns->Ref()->AsRecordType();
streams[idx]->max_delay_interval = sval->GetField("max_delay_interval")->AsTime();
streams[idx]->max_delay_queue_size = sval->GetField("max_delay_queue_size")->AsCount();
streams[idx]->enable_remote = id::find_val("Log::enable_remote_logging")->AsBool(); streams[idx]->enable_remote = id::find_val("Log::enable_remote_logging")->AsBool();

72
testing/btest/Baseline/plugins.hooks/output
View file

@ -62,30 +62,6 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Tunnel::LOG, [columns=Tunnel::Info, ev=<uninitialized>, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) -> <no result> 0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Tunnel::LOG, [columns=Tunnel::Info, ev=<uninitialized>, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) -> <no result> 0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__enable_stream, <frame>, (Analyzer::Logging::LOG)) -> <no result> 0.000000 MetaHookPost CallFunction(Log::__enable_stream, <frame>, (Analyzer::Logging::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Analyzer::Logging::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Broker::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Cluster::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Config::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Conn::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (DPD::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Files::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (HTTP::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Notice::ALARM_LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Notice::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Tunnel::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_interval, <frame>, (Weird::LOG, 200.0 msecs)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Analyzer::Logging::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Broker::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Cluster::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Config::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Conn::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (DPD::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Files::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (HTTP::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Notice::ALARM_LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Notice::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Tunnel::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__set_max_delay_queue_size, <frame>, (Weird::LOG, 1000)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Analyzer::Logging::LOG)) -> <no result> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Analyzer::Logging::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
@ -1004,30 +980,6 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Tunnel::LOG, [columns=Tunnel::Info, ev=<uninitialized>, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Tunnel::LOG, [columns=Tunnel::Info, ev=<uninitialized>, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000]))
0.000000 MetaHookPre CallFunction(Log::__enable_stream, <frame>, (Analyzer::Logging::LOG)) 0.000000 MetaHookPre CallFunction(Log::__enable_stream, <frame>, (Analyzer::Logging::LOG))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Analyzer::Logging::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Broker::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Cluster::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Config::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Conn::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (DPD::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Files::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (HTTP::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Notice::ALARM_LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Notice::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Tunnel::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_interval, <frame>, (Weird::LOG, 200.0 msecs))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Analyzer::Logging::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Broker::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Cluster::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Config::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Conn::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (DPD::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Files::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (HTTP::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Notice::ALARM_LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Notice::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Tunnel::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::__set_max_delay_queue_size, <frame>, (Weird::LOG, 1000))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Analyzer::Logging::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Analyzer::Logging::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Broker::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
@ -1945,30 +1897,6 @@
0.000000 | HookCallFunction Log::__create_stream(Tunnel::LOG, [columns=Tunnel::Info, ev=<uninitialized>, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000]) 0.000000 | HookCallFunction Log::__create_stream(Tunnel::LOG, [columns=Tunnel::Info, ev=<uninitialized>, path=tunnel, policy=Tunnel::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000]) 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird, policy=Weird::log_policy, event_groups={}, max_delay_interval=200.0 msecs, max_delay_queue_size=1000])
0.000000 | HookCallFunction Log::__enable_stream(Analyzer::Logging::LOG) 0.000000 | HookCallFunction Log::__enable_stream(Analyzer::Logging::LOG)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Analyzer::Logging::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Broker::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Cluster::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Config::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Conn::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(DPD::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Files::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(HTTP::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Notice::ALARM_LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Notice::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Tunnel::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_interval(Weird::LOG, 200.0 msecs)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Analyzer::Logging::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Broker::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Cluster::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Config::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Conn::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(DPD::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Files::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(HTTP::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Notice::ALARM_LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Notice::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Tunnel::LOG, 1000)
0.000000 | HookCallFunction Log::__set_max_delay_queue_size(Weird::LOG, 1000)
0.000000 | HookCallFunction Log::add_default_filter(Analyzer::Logging::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Analyzer::Logging::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)