diff --git a/scripts/base/frameworks/notice/cluster.bro b/scripts/base/frameworks/notice/cluster.bro index f197761acf..3c3fbc6d36 100644 --- a/scripts/base/frameworks/notice/cluster.bro +++ b/scripts/base/frameworks/notice/cluster.bro @@ -23,7 +23,8 @@ redef Cluster::worker2manager_events += /Notice::cluster_notice/; @if ( Cluster::local_node_type() != Cluster::MANAGER ) event Notice::begin_suppression(n: Notice::Info) { - suppressing[n$note, n$identifier] = n; + local suppress_until = n$ts + n$suppress_for; + suppressing[n$note, n$identifier] = suppress_until; } @endif diff --git a/scripts/base/frameworks/notice/main.bro b/scripts/base/frameworks/notice/main.bro index a5f17a4979..dac87662c4 100644 --- a/scripts/base/frameworks/notice/main.bro +++ b/scripts/base/frameworks/notice/main.bro @@ -242,12 +242,6 @@ export { ## being suppressed. global suppressed: event(n: Notice::Info); - ## This event is generated when a notice stops being suppressed. - ## - ## n: The record containing notice data regarding the notice type - ## that was being suppressed. - global end_suppression: event(n: Notice::Info); - ## Call this function to send a notice in an email. It is already used ## by default with the built in :bro:enum:`Notice::ACTION_EMAIL` and ## :bro:enum:`Notice::ACTION_PAGE` actions. @@ -285,27 +279,22 @@ export { } # This is used as a hack to implement per-item expiration intervals. -function per_notice_suppression_interval(t: table[Notice::Type, string] of Notice::Info, idx: any): interval +function per_notice_suppression_interval(t: table[Notice::Type, string] of time, idx: any): interval { local n: Notice::Type; local s: string; [n,s] = idx; - local suppress_time = t[n,s]$suppress_for - (network_time() - t[n,s]$ts); + local suppress_time = t[n,s] - network_time(); if ( suppress_time < 0secs ) suppress_time = 0secs; - # If there is no more suppression time left, the notice needs to be sent - # to the end_suppression event. - if ( suppress_time == 0secs ) - event Notice::end_suppression(t[n,s]); - return suppress_time; } # This is the internally maintained notice suppression table. It's # indexed on the Notice::Type and the $identifier field from the notice. -global suppressing: table[Type, string] of Notice::Info = {} +global suppressing: table[Type, string] of time = {} &create_expire=0secs &expire_func=per_notice_suppression_interval; @@ -467,7 +456,8 @@ hook Notice::notice(n: Notice::Info) &priority=-5 [n$note, n$identifier] !in suppressing && n$suppress_for != 0secs ) { - suppressing[n$note, n$identifier] = n; + local suppress_until = n$ts + n$suppress_for; + suppressing[n$note, n$identifier] = suppress_until; event Notice::begin_suppression(n); } }