Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/awelzel/3112-log-suffix-left-over-log-rotation'

Browse source 
* topic/awelzel/3112-log-suffix-left-over-log-rotation:
  cluster/logger: Fix leftover-log-rotation in multi-logger setups
  cluster/logger: Fix global var reference
This commit is contained in:
Arne Welzel 2023-06-13 17:33:31 +02:00
commit f53aefdd5b
5 changed files with 82 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

33
scripts/base/frameworks/cluster/nodes/logger.zeek
View file

@ -22,16 +22,24 @@ redef Log::default_rotation_interval = 1 hrs;
## Alarm summary mail interval.
redef Log::default_mail_alarms_interval = 24 hrs;
## Generic log metadata rendered into the filename that zeek-archiver may interpret.
## This is populated with a log_suffix entry within zeek_init() when multiple
## logger nodes are defined in cluster-layout.zeek.
global log_metadata: table[string] of string;
## Generic log metadata rendered into filename that zeek-archiver may interpret.
global archiver_log_metadata: table[string] of string &redef;
# Populate archiver_log_metadata with a "log_suffix" entry when multiple
# loggers are configured in Cluster::nodes. Need to evaluate at script
# loading time as leftover-log-rotation functionality is invoking
# archiver_rotation_format_func early on during InitPostScript().
@if ( Cluster::get_node_count(Cluster::LOGGER) > 1 )
redef archiver_log_metadata += {
["log_suffix"] = Cluster::node,
};
@endif
## Encode the given table as zeek-archiver understood metadata part.
function encode_log_metadata(tbl: table[string] of string): string
function archiver_encode_log_metadata(tbl: table[string] of string): string
{
local metadata_vec: vector of string;
for ( k, v in log_metadata )
for ( k, v in tbl )
{
if ( |v| == 0 ) # Assume concious decision to skip this entry.
next;
@ -57,8 +65,8 @@ function archiver_rotation_format_func(ri: Log::RotationFmtInfo): Log::RotationP
local close_str = strftime(Log::default_rotation_date_format, ri$close);
local base = fmt("%s__%s__%s__", ri$path, open_str, close_str);
if ( |log_metadata| > 0 )
base = fmt("%s%s__", base, encode_log_metadata(log_metadata));
if ( |archiver_log_metadata| > 0 )
base = fmt("%s%s__", base, archiver_encode_log_metadata(archiver_log_metadata));
local rval = Log::RotationPath($file_basename=base);
return rval;
@ -71,15 +79,6 @@ redef Log::default_rotation_dir = "log-queue";
redef Log::rotation_format_func = archiver_rotation_format_func;
redef LogAscii::enable_leftover_log_rotation = T;
event zeek_init()
{
if ( "log_suffix" in log_metadata )
return;
if ( Cluster::get_node_count(Cluster::LOGGER) > 1 )
log_metadata["log_suffix"] = Cluster::node;
}
@else
## Use the cluster's archive logging script.