mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Add Supervisor BIF/event API skeleton
This commit is contained in:
Jon Siwek
parent
52f7647f25
commit
e46cf88435
16 changed files with 232 additions and 12 deletions
2
scripts/base/frameworks/supervisor/__load__.zeek
Normal file
2
scripts/base/frameworks/supervisor/__load__.zeek
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
@load ./api
|
||||
@load ./main
|
||||
35
scripts/base/frameworks/supervisor/api.zeek
Normal file
35
scripts/base/frameworks/supervisor/api.zeek
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
##! The Zeek process supervision API.
|
||||
# TODO: add proper docs
|
||||
|
||||
module Supervisor;
|
||||
|
||||
export {
|
||||
type Status: record {
|
||||
# TODO: add proper status fields
|
||||
n: count;
|
||||
};
|
||||
|
||||
type NodeConfig: record {
|
||||
# TODO: add proper config field
|
||||
name: string;
|
||||
};
|
||||
|
||||
global status: function(nodes: string &default="all"): Status;
|
||||
global create: function(config: NodeConfig): string;
|
||||
global destroy: function(nodes: string): bool;
|
||||
global restart: function(nodes: string &default="all"): bool;
|
||||
|
||||
global Supervisor::stop_request: event();
|
||||
|
||||
global Supervisor::status_request: event(id: count, nodes: string);
|
||||
global Supervisor::status_response: event(id: count, result: Status);
|
||||
|
||||
global Supervisor::create_request: event(id: count, config: NodeConfig);
|
||||
global Supervisor::create_response: event(id: count, result: string);
|
||||
|
||||
global Supervisor::destroy_request: event(id: count, nodes: string);
|
||||
global Supervisor::destroy_response: event(id: count, result: bool);
|
||||
|
||||
global Supervisor::restart_request: event(id: count, nodes: string);
|
||||
global Supervisor::restart_response: event(id: count, result: bool);
|
||||
}
|
||||
70
scripts/base/frameworks/supervisor/main.zeek
Normal file
70
scripts/base/frameworks/supervisor/main.zeek
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
##! Implements Zeek process supervision configuration options and default
|
||||
##! behavior.
|
||||
# TODO: add proper docs
|
||||
|
||||
@load ./api
|
||||
@load base/frameworks/broker
|
||||
|
||||
module Supervisor;
|
||||
|
||||
export {
|
||||
const topic_prefix = "zeek/supervisor" &redef;
|
||||
}
|
||||
|
||||
event zeek_init() &priority=10
|
||||
{
|
||||
Broker::subscribe(Supervisor::topic_prefix);
|
||||
}
|
||||
|
||||
event Supervisor::stop_request()
|
||||
{
|
||||
terminate();
|
||||
}
|
||||
|
||||
event Supervisor::status_request(id: count, nodes: string)
|
||||
{
|
||||
local res = Supervisor::status(nodes);
|
||||
local topic = Supervisor::topic_prefix + "/status_response";
|
||||
Broker::publish(topic, Supervisor::status_response, id, res);
|
||||
}
|
||||
|
||||
event Supervisor::create_request(id: count, config: NodeConfig)
|
||||
{
|
||||
local res = Supervisor::create(config);
|
||||
local topic = Supervisor::topic_prefix + "/create_response";
|
||||
Broker::publish(topic, Supervisor::create_response, id, res);
|
||||
}
|
||||
|
||||
event Supervisor::destroy_request(id: count, nodes: string)
|
||||
{
|
||||
local res = Supervisor::destroy(nodes);
|
||||
local topic = Supervisor::topic_prefix + "/destroy_response";
|
||||
Broker::publish(topic, Supervisor::destroy_response, id, res);
|
||||
}
|
||||
|
||||
event Supervisor::restart_request(id: count, nodes: string)
|
||||
{
|
||||
local res = Supervisor::restart(nodes);
|
||||
local topic = Supervisor::topic_prefix + "/restart_response";
|
||||
Broker::publish(topic, Supervisor::restart_response, id, res);
|
||||
}
|
||||
|
||||
function Supervisor::status(nodes: string): Status
|
||||
{
|
||||
return Supervisor::__status(nodes);
|
||||
}
|
||||
|
||||
function create(config: NodeConfig): string
|
||||
{
|
||||
return Supervisor::__create(config);
|
||||
}
|
||||
|
||||
function destroy(nodes: string): bool
|
||||
{
|
||||
return Supervisor::__destroy(nodes);
|
||||
}
|
||||
|
||||
function restart(nodes: string): bool
|
||||
{
|
||||
return Supervisor::__restart(nodes);
|
||||
}
|
||||
|
|
@ -1781,6 +1781,8 @@ type gtp_delete_pdp_ctx_response_elements: record {
|
|||
@load base/bif/reporter.bif
|
||||
@load base/bif/strings.bif
|
||||
@load base/bif/option.bif
|
||||
@load base/frameworks/supervisor/api
|
||||
@load base/bif/supervisor.bif
|
||||
|
||||
global done_with_network = F;
|
||||
event net_done(t: time) { done_with_network = T; }
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@
|
|||
# the separate file).
|
||||
@load base/frameworks/logging
|
||||
@load base/frameworks/broker
|
||||
@load base/frameworks/supervisor
|
||||
@load base/frameworks/input
|
||||
@load base/frameworks/analyzer
|
||||
@load base/frameworks/files
|
||||
|
|
|
|||
|
|
@ -111,6 +111,7 @@ set(BIF_SRCS
|
|||
strings.bif
|
||||
reporter.bif
|
||||
option.bif
|
||||
supervisor.bif
|
||||
)
|
||||
|
||||
foreach (bift ${BIF_SRCS})
|
||||
|
|
|
|||
|
|
@ -717,12 +717,14 @@ void builtin_error(const char* msg, BroObj* arg)
|
|||
#include "reporter.bif.func_h"
|
||||
#include "strings.bif.func_h"
|
||||
#include "option.bif.func_h"
|
||||
#include "supervisor.bif.func_h"
|
||||
|
||||
#include "zeek.bif.func_def"
|
||||
#include "stats.bif.func_def"
|
||||
#include "reporter.bif.func_def"
|
||||
#include "strings.bif.func_def"
|
||||
#include "option.bif.func_def"
|
||||
#include "supervisor.bif.func_def"
|
||||
|
||||
#include "__all__.bif.cc" // Autogenerated for compiling in the bif_target() code.
|
||||
#include "__all__.bif.register.cc" // Autogenerated for compiling in the bif_target() code.
|
||||
|
|
@ -750,6 +752,7 @@ void init_builtin_funcs()
|
|||
#include "reporter.bif.func_init"
|
||||
#include "strings.bif.func_init"
|
||||
#include "option.bif.func_init"
|
||||
#include "supervisor.bif.func_init"
|
||||
|
||||
did_builtin_init = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -196,6 +196,7 @@ bro_uint_t bits_per_uid;
|
|||
#include "types.bif.netvar_def"
|
||||
#include "event.bif.netvar_def"
|
||||
#include "reporter.bif.netvar_def"
|
||||
#include "supervisor.bif.netvar_def"
|
||||
|
||||
void init_event_handlers()
|
||||
{
|
||||
|
|
@ -240,6 +241,7 @@ void init_net_var()
|
|||
#include "const.bif.netvar_init"
|
||||
#include "types.bif.netvar_init"
|
||||
#include "reporter.bif.netvar_init"
|
||||
#include "supervisor.bif.netvar_init"
|
||||
|
||||
conn_id = internal_type("conn_id")->AsRecordType();
|
||||
endpoint = internal_type("endpoint")->AsRecordType();
|
||||
|
|
|
|||
|
|
@ -203,3 +203,4 @@ extern void init_net_var();
|
|||
#include "types.bif.netvar_h"
|
||||
#include "event.bif.netvar_h"
|
||||
#include "reporter.bif.netvar_h"
|
||||
#include "supervisor.bif.netvar_h"
|
||||
|
|
|
|||
|
|
@ -8,6 +8,8 @@
|
|||
#include "Supervisor.h"
|
||||
#include "Reporter.h"
|
||||
#include "DebugLogger.h"
|
||||
#include "Val.h"
|
||||
#include "NetVar.h"
|
||||
#include "zeek-config.h"
|
||||
#include "util.h"
|
||||
|
||||
|
|
@ -212,3 +214,30 @@ void zeek::Supervisor::RunStem(std::unique_ptr<bro::Pipe> pipe)
|
|||
write(pipe->WriteFD(), "hi", 2);
|
||||
}
|
||||
}
|
||||
|
||||
RecordVal* zeek::Supervisor::Status(const std::string& nodes)
|
||||
{
|
||||
// TODO: return real status information
|
||||
static auto count = 0;
|
||||
auto rval = new RecordVal(BifType::Record::Supervisor::Status);
|
||||
rval->Assign(0, val_mgr->GetCount(count++));
|
||||
return rval;
|
||||
}
|
||||
|
||||
std::string zeek::Supervisor::Create(const RecordVal* node_config)
|
||||
{
|
||||
// TODO: return error msg on fail, or empty on success
|
||||
return "";
|
||||
}
|
||||
|
||||
bool zeek::Supervisor::Destroy(const std::string& nodes)
|
||||
{
|
||||
// TODO: return true if a matching node exists
|
||||
return false;
|
||||
}
|
||||
|
||||
bool zeek::Supervisor::Restart(const std::string& nodes)
|
||||
{
|
||||
// TODO: return true if a matching node exists
|
||||
return false;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -33,6 +33,11 @@ public:
|
|||
|
||||
void ObserveChildSignal();
|
||||
|
||||
RecordVal* Status(const std::string& nodes);
|
||||
std::string Create(const RecordVal* node_config);
|
||||
bool Destroy(const std::string& nodes);
|
||||
bool Restart(const std::string& nodes);
|
||||
|
||||
private:
|
||||
|
||||
// IOSource interface overrides:
|
||||
|
|
|
|||
35
src/supervisor.bif
Normal file
35
src/supervisor.bif
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
##! The BIFs that define the Zeek supervisor control interface.
|
||||
|
||||
%%{
|
||||
#include "Supervisor.h"
|
||||
%%}
|
||||
|
||||
module Supervisor;
|
||||
|
||||
type Supervisor::Status: record;
|
||||
type Supervisor::NodeConfig: record;
|
||||
|
||||
function Supervisor::__status%(nodes: string%): Supervisor::Status
|
||||
%{
|
||||
return zeek::supervisor->Status(nodes->CheckString());
|
||||
%}
|
||||
|
||||
function Supervisor::__create%(config: Supervisor::NodeConfig%): string
|
||||
%{
|
||||
auto rval = zeek::supervisor->Create(config->AsRecordVal());
|
||||
return new StringVal(rval);
|
||||
%}
|
||||
|
||||
function Supervisor::__destroy%(nodes: string%): bool
|
||||
%{
|
||||
auto rval = zeek::supervisor->Destroy(nodes->CheckString());
|
||||
return val_mgr->GetBool(rval);
|
||||
%}
|
||||
|
||||
function Supervisor::__restart%(nodes: string%): bool
|
||||
%{
|
||||
auto rval = zeek::supervisor->Restart(nodes->CheckString());
|
||||
return val_mgr->GetBool(rval);
|
||||
%}
|
||||
|
||||
# TODO: BIFs for "restart", "add", "remove" operations
|
||||
|
|
@ -1,3 +1,8 @@
|
|||
warning in <params>, line 1: event handler never invoked: this_is_never_used
|
||||
warning in <params>, line 1: event handler never invoked: InputConfig::new_value
|
||||
warning in <params>, line 1: event handler never invoked: InputRaw::process_finished
|
||||
warning in <params>, line 1: event handler never invoked: Supervisor::create_request
|
||||
warning in <params>, line 1: event handler never invoked: Supervisor::destroy_request
|
||||
warning in <params>, line 1: event handler never invoked: Supervisor::restart_request
|
||||
warning in <params>, line 1: event handler never invoked: Supervisor::status_request
|
||||
warning in <params>, line 1: event handler never invoked: Supervisor::stop_request
|
||||
warning in <params>, line 1: event handler never invoked: this_is_never_used
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2019-07-29-19-05-26
|
||||
#open 2019-10-15-01-48-24
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.zeek
|
||||
|
|
@ -14,6 +14,8 @@ scripts/base/init-bare.zeek
|
|||
build/scripts/base/bif/reporter.bif.zeek
|
||||
build/scripts/base/bif/strings.bif.zeek
|
||||
build/scripts/base/bif/option.bif.zeek
|
||||
scripts/base/frameworks/supervisor/api.zeek
|
||||
build/scripts/base/bif/supervisor.bif.zeek
|
||||
build/scripts/base/bif/plugins/Zeek_SNMP.types.bif.zeek
|
||||
build/scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek
|
||||
build/scripts/base/bif/event.bif.zeek
|
||||
|
|
@ -35,6 +37,8 @@ scripts/base/init-frameworks-and-bifs.zeek
|
|||
build/scripts/base/bif/data.bif.zeek
|
||||
build/scripts/base/bif/store.bif.zeek
|
||||
scripts/base/frameworks/broker/log.zeek
|
||||
scripts/base/frameworks/supervisor/__load__.zeek
|
||||
scripts/base/frameworks/supervisor/main.zeek
|
||||
scripts/base/frameworks/input/__load__.zeek
|
||||
scripts/base/frameworks/input/main.zeek
|
||||
build/scripts/base/bif/input.bif.zeek
|
||||
|
|
@ -181,4 +185,4 @@ scripts/base/init-frameworks-and-bifs.zeek
|
|||
build/scripts/base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
|
||||
scripts/policy/misc/loaded-scripts.zeek
|
||||
scripts/base/utils/paths.zeek
|
||||
#close 2019-07-29-19-05-26
|
||||
#close 2019-10-15-01-48-24
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2019-08-06-00-02-39
|
||||
#open 2019-10-15-01-48-24
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.zeek
|
||||
|
|
@ -14,6 +14,8 @@ scripts/base/init-bare.zeek
|
|||
build/scripts/base/bif/reporter.bif.zeek
|
||||
build/scripts/base/bif/strings.bif.zeek
|
||||
build/scripts/base/bif/option.bif.zeek
|
||||
scripts/base/frameworks/supervisor/api.zeek
|
||||
build/scripts/base/bif/supervisor.bif.zeek
|
||||
build/scripts/base/bif/plugins/Zeek_SNMP.types.bif.zeek
|
||||
build/scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek
|
||||
build/scripts/base/bif/event.bif.zeek
|
||||
|
|
@ -35,6 +37,8 @@ scripts/base/init-frameworks-and-bifs.zeek
|
|||
build/scripts/base/bif/data.bif.zeek
|
||||
build/scripts/base/bif/store.bif.zeek
|
||||
scripts/base/frameworks/broker/log.zeek
|
||||
scripts/base/frameworks/supervisor/__load__.zeek
|
||||
scripts/base/frameworks/supervisor/main.zeek
|
||||
scripts/base/frameworks/input/__load__.zeek
|
||||
scripts/base/frameworks/input/main.zeek
|
||||
build/scripts/base/bif/input.bif.zeek
|
||||
|
|
@ -375,4 +379,4 @@ scripts/base/init-default.zeek
|
|||
scripts/base/misc/find-filtered-trace.zeek
|
||||
scripts/base/misc/version.zeek
|
||||
scripts/policy/misc/loaded-scripts.zeek
|
||||
#close 2019-08-06-00-02-39
|
||||
#close 2019-10-15-01-48-25
|
||||
|
|
|
|||
|
|
@ -157,6 +157,8 @@
|
|||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_TEREDO, {3544/udp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_VXLAN, {4789/udp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_XMPP, {5222<...>/tcp})) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Broker::__subscribe, <frame>, (zeek/supervisor)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Broker::subscribe, <frame>, (zeek/supervisor)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Cluster::is_enabled, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Cluster::is_enabled, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Cluster::local_node_type, <null>, ()) -> <no result>
|
||||
|
|
@ -274,7 +276,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Config::LOG)) -> <no result>
|
||||
|
|
@ -455,7 +457,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::init, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
||||
|
|
@ -693,6 +695,7 @@
|
|||
0.000000 MetaHookPost LoadFile(0, .<...>/add-geodata.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/addrs.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/analyzer.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/api.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/ascii.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/average.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/benchmark.zeek) -> -1
|
||||
|
|
@ -766,6 +769,7 @@
|
|||
0.000000 MetaHookPost LoadFile(0, .<...>/store.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/strings.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/sum.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/supervisor.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/thresholds.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/top-k.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, .<...>/topk.zeek) -> -1
|
||||
|
|
@ -787,6 +791,7 @@
|
|||
0.000000 MetaHookPost LoadFile(0, base<...>/addrs.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/analyzer) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/analyzer.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/api.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/bif) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/broker) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/cluster) -> -1
|
||||
|
|
@ -867,6 +872,8 @@
|
|||
0.000000 MetaHookPost LoadFile(0, base<...>/strings.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/strings.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/sumstats) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/supervisor) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/supervisor.bif.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/syslog) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/thresholds.zeek) -> -1
|
||||
0.000000 MetaHookPost LoadFile(0, base<...>/time.zeek) -> -1
|
||||
|
|
@ -1052,6 +1059,8 @@
|
|||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_TEREDO, {3544/udp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_VXLAN, {4789/udp}))
|
||||
0.000000 MetaHookPre CallFunction(Analyzer::register_for_ports, <frame>, (Analyzer::ANALYZER_XMPP, {5222<...>/tcp}))
|
||||
0.000000 MetaHookPre CallFunction(Broker::__subscribe, <frame>, (zeek/supervisor))
|
||||
0.000000 MetaHookPre CallFunction(Broker::subscribe, <frame>, (zeek/supervisor))
|
||||
0.000000 MetaHookPre CallFunction(Cluster::is_enabled, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(Cluster::is_enabled, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(Cluster::local_node_type, <null>, ())
|
||||
|
|
@ -1169,7 +1178,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Broker::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Config::LOG))
|
||||
|
|
@ -1350,7 +1359,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(NetControl::init, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
||||
|
|
@ -1588,6 +1597,7 @@
|
|||
0.000000 MetaHookPre LoadFile(0, .<...>/add-geodata.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/addrs.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/analyzer.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/api.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/ascii.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/average.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/benchmark.zeek)
|
||||
|
|
@ -1661,6 +1671,7 @@
|
|||
0.000000 MetaHookPre LoadFile(0, .<...>/store.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/strings.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/sum.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/supervisor.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/thresholds.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/top-k.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, .<...>/topk.zeek)
|
||||
|
|
@ -1682,6 +1693,7 @@
|
|||
0.000000 MetaHookPre LoadFile(0, base<...>/addrs.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/analyzer)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/analyzer.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/api.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/bif)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/broker)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/cluster)
|
||||
|
|
@ -1762,6 +1774,8 @@
|
|||
0.000000 MetaHookPre LoadFile(0, base<...>/strings.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/strings.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/sumstats)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/supervisor)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/supervisor.bif.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/syslog)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/thresholds.zeek)
|
||||
0.000000 MetaHookPre LoadFile(0, base<...>/time.zeek)
|
||||
|
|
@ -1947,6 +1961,8 @@
|
|||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_TEREDO, {3544/udp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_VXLAN, {4789/udp})
|
||||
0.000000 | HookCallFunction Analyzer::register_for_ports(Analyzer::ANALYZER_XMPP, {5222<...>/tcp})
|
||||
0.000000 | HookCallFunction Broker::__subscribe(zeek/supervisor)
|
||||
0.000000 | HookCallFunction Broker::subscribe(zeek/supervisor)
|
||||
0.000000 | HookCallFunction Cluster::is_enabled()
|
||||
0.000000 | HookCallFunction Cluster::local_node_type()
|
||||
0.000000 | HookCallFunction Cluster::register_pool([topic=zeek<...>/logger, node_type=Cluster::LOGGER, max_nodes=<uninitialized>, exclusive=F])
|
||||
|
|
@ -2063,7 +2079,7 @@
|
|||
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Config::LOG)
|
||||
|
|
@ -2244,7 +2260,7 @@
|
|||
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction NetControl::check_plugins()
|
||||
0.000000 | HookCallFunction NetControl::init()
|
||||
0.000000 | HookCallFunction Notice::want_pp()
|
||||
|
|
@ -2482,6 +2498,7 @@
|
|||
0.000000 | HookLoadFile .<...>/add-geodata.zeek
|
||||
0.000000 | HookLoadFile .<...>/addrs.zeek
|
||||
0.000000 | HookLoadFile .<...>/analyzer.bif.zeek
|
||||
0.000000 | HookLoadFile .<...>/api.zeek
|
||||
0.000000 | HookLoadFile .<...>/archive.sig
|
||||
0.000000 | HookLoadFile .<...>/ascii.zeek
|
||||
0.000000 | HookLoadFile .<...>/audio.sig
|
||||
|
|
@ -2563,6 +2580,7 @@
|
|||
0.000000 | HookLoadFile .<...>/store.zeek
|
||||
0.000000 | HookLoadFile .<...>/strings.bif.zeek
|
||||
0.000000 | HookLoadFile .<...>/sum.zeek
|
||||
0.000000 | HookLoadFile .<...>/supervisor.bif.zeek
|
||||
0.000000 | HookLoadFile .<...>/thresholds.zeek
|
||||
0.000000 | HookLoadFile .<...>/top-k.bif.zeek
|
||||
0.000000 | HookLoadFile .<...>/topk.zeek
|
||||
|
|
@ -2585,6 +2603,7 @@
|
|||
0.000000 | HookLoadFile base<...>/addrs.zeek
|
||||
0.000000 | HookLoadFile base<...>/analyzer
|
||||
0.000000 | HookLoadFile base<...>/analyzer.bif.zeek
|
||||
0.000000 | HookLoadFile base<...>/api.zeek
|
||||
0.000000 | HookLoadFile base<...>/bif
|
||||
0.000000 | HookLoadFile base<...>/broker
|
||||
0.000000 | HookLoadFile base<...>/cluster
|
||||
|
|
@ -2665,6 +2684,8 @@
|
|||
0.000000 | HookLoadFile base<...>/strings.bif.zeek
|
||||
0.000000 | HookLoadFile base<...>/strings.zeek
|
||||
0.000000 | HookLoadFile base<...>/sumstats
|
||||
0.000000 | HookLoadFile base<...>/supervisor
|
||||
0.000000 | HookLoadFile base<...>/supervisor.bif.zeek
|
||||
0.000000 | HookLoadFile base<...>/syslog
|
||||
0.000000 | HookLoadFile base<...>/thresholds.zeek
|
||||
0.000000 | HookLoadFile base<...>/time.zeek
|
||||
|
|
@ -2678,7 +2699,7 @@
|
|||
0.000000 | HookLoadFile base<...>/xmpp
|
||||
0.000000 | HookLoadFile base<...>/zeek.bif.zeek
|
||||
0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)}
|
||||
0.000000 | HookLogWrite packet_filter [ts=1565053246.404549, node=zeek, filter=ip or not ip, init=T, success=T]
|
||||
0.000000 | HookLogWrite packet_filter [ts=1571104127.525167, node=zeek, filter=ip or not ip, init=T, success=T]
|
||||
0.000000 | HookQueueEvent NetControl::init()
|
||||
0.000000 | HookQueueEvent filter_change_tracking()
|
||||
0.000000 | HookQueueEvent zeek_init()
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue