Merge remote-tracking branch 'origin/topic/johanna/new-style-analyzer-log'

* origin/topic/johanna/new-style-analyzer-log:
  NEWS entries for analyzer log changes
  Move detect-protocol from frameworks/dpd to frameworks/analyzer
  Introduce new c$failed_analyzers field
  Settle on analyzer.log for the dpd.log replacement
  dpd->analyzer.log change - rename files
  Analyzer failure logging: tweaks and test fixes
  Introduce analyzer-failed.log, as a replacement for dpd.log
  Rename analyzer.log to analyzer.debug log; move to policy
  Move dpd.log to policy script
This commit is contained in:
Johanna Amann 2025-06-05 07:15:59 +01:00
commit e6755325e1
127 changed files with 5151 additions and 4742 deletions

View file

@ -1 +1 @@
5fd78ecbdd834feff545f3a3c19b974d927ffb91
df50a397af13e9ced49191b2983c532fc3565e4e

View file

@ -1 +1 @@
f7c740ab3c2781252ab7d0620715091f6b61ae5d
adbe7e86bb4c9ae7975d1e85b9c55e71e5fcdf57

View file

@ -25,4 +25,6 @@ redef Intel::manage_seen_event_groups = F;
# The IMAP analyzer includes absolute filenames in its error messages,
# exclude it for now from analyzer.log.
# https://github.com/zeek/zeek/issues/2659
redef Analyzer::Logging::ignore_analyzers += { Analyzer::ANALYZER_IMAP };
redef Analyzer::DebugLogging::ignore_analyzers += { Analyzer::ANALYZER_IMAP };
redef Analyzer::DebugLogging::include_confirmations = F;
redef Analyzer::DebugLogging::include_disabling = F;