Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/new-style-analyzer-log'

Browse source 
* origin/topic/johanna/new-style-analyzer-log:
  NEWS entries for analyzer log changes
  Move detect-protocol from frameworks/dpd to frameworks/analyzer
  Introduce new c$failed_analyzers field
  Settle on analyzer.log for the dpd.log replacement
  dpd->analyzer.log change - rename files
  Analyzer failure logging: tweaks and test fixes
  Introduce analyzer-failed.log, as a replacement for dpd.log
  Rename analyzer.log to analyzer.debug log; move to policy
  Move dpd.log to policy script
This commit is contained in:
Johanna Amann 2025-06-05 07:15:59 +01:00
commit e6755325e1
127 changed files with 5151 additions and 4742 deletions
Download patch file Download diff file Expand all files Collapse all files

19
testing/btest/scripts/base/frameworks/analyzer/logging.zeek
View file

@ -1,19 +0,0 @@
# @TEST-EXEC: zeek -r ${TRACES}/socks.trace %INPUT
# @TEST-EXEC: mv analyzer.log analyzer.log-default
# @TEST-EXEC: btest-diff analyzer.log-default
# @TEST-EXEC: zeek -r ${TRACES}/socks.trace %INPUT Analyzer::Logging::include_confirmations=T
# @TEST-EXEC: mv analyzer.log analyzer.log-include-confirmations
# @TEST-EXEC: btest-diff analyzer.log-include-confirmations
# @TEST-EXEC: zeek -r ${TRACES}/socks.trace %INPUT Analyzer::Logging::include_disabling=T
# @TEST-EXEC: mv analyzer.log analyzer.log-include-disabling
# @TEST-EXEC: btest-diff analyzer.log-include-disabling
@load base/protocols/conn
@load base/protocols/dns
@load base/protocols/socks
# DCE RPC violations are ignored by default. Consider violations for this
# test so that the analyzer will be disabled eventually.
redef DPD::ignore_violations -= { Analyzer::ANALYZER_DCE_RPC };