diff --git a/CHANGES b/CHANGES
index 4e8d2ada45..c51cd00bbf 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,11 @@
+2.5-850 | 2018-08-17 11:12:53 -0500
+
+ * BIT-1815: move SMB::write_cmd_log functionality into policy/ script
+
+ The option is removed, but same functionality is now enabled simply
+ by loading policy/protocols/smb/log-cmds.bro (Jon Siwek, Corelight)
+
2.5-849 | 2018-08-17 10:29:58 -0500
* Fix possible race in netcontrol acld/broker plugins (Jon Siwek, Corelight)
diff --git a/NEWS b/NEWS
index 1809cd4bd6..e5f5b28054 100644
--- a/NEWS
+++ b/NEWS
@@ -384,6 +384,10 @@ Changed Functionality
- smb1_transaction2_request now has an additional "args" record argument
+- The SMB::write_cmd_log option has been removed and the corresponding
+ logic moving to policy/protocols/smb/log-cmds.bro which can simply
+ be loaded to produce the same effect of toggling the old flag on.
+
- SSL event argument changes:
- event ssl_server_signature now has an additional argument
diff --git a/VERSION b/VERSION
index 0eef8063da..3e949de53a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.5-849
+2.5-850
diff --git a/scripts/base/protocols/smb/main.bro b/scripts/base/protocols/smb/main.bro
index a2226ded33..7e8969594d 100644
--- a/scripts/base/protocols/smb/main.bro
+++ b/scripts/base/protocols/smb/main.bro
@@ -6,7 +6,6 @@ module SMB;
export {
redef enum Log::ID += {
- CMD_LOG,
AUTH_LOG,
MAPPING_LOG,
FILES_LOG
@@ -43,11 +42,6 @@ export {
PRINT_CLOSE,
} &redef;
- ## The server response statuses which are *not* logged.
- const ignored_command_statuses: set[string] = {
- "MORE_PROCESSING_REQUIRED",
- } &redef;
-
## This record is for the smb_files.log
type FileInfo: record {
## Time when the file was first discovered.
@@ -159,25 +153,12 @@ export {
recent_files : set[string] &default=string_set() &read_expire=3min;
};
- ## Optionally write out the SMB commands log. This is
- ## primarily useful for debugging so is disabled by default.
- const write_cmd_log = F &redef;
-
## Everything below here is used internally in the SMB scripts.
redef record connection += {
smb_state : State &optional;
};
- ## Internal use only.
- ## Some commands shouldn't be logged by the smb1_message event.
- const deferred_logging_cmds: set[string] = {
- "NEGOTIATE",
- "READ_ANDX",
- "SESSION_SETUP_ANDX",
- "TREE_CONNECT_ANDX",
- };
-
## This is an internally used function.
const set_current_file: function(smb_state: State, file_id: count) &redef;
@@ -198,7 +179,6 @@ redef likely_server_ports += { ports };
event bro_init() &priority=5
{
- Log::create_stream(SMB::CMD_LOG, [$columns=SMB::CmdInfo, $path="smb_cmd"]);
Log::create_stream(SMB::FILES_LOG, [$columns=SMB::FileInfo, $path="smb_files"]);
Log::create_stream(SMB::MAPPING_LOG, [$columns=SMB::TreeInfo, $path="smb_mapping"]);
diff --git a/scripts/base/protocols/smb/smb1-main.bro b/scripts/base/protocols/smb/smb1-main.bro
index 6b23fe91db..44210e88f0 100644
--- a/scripts/base/protocols/smb/smb1-main.bro
+++ b/scripts/base/protocols/smb/smb1-main.bro
@@ -68,17 +68,10 @@ event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=5
event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=-5
{
- # Is this a response?
- if ( !is_orig )
- {
- if ( SMB::write_cmd_log &&
- c$smb_state$current_cmd$status !in SMB::ignored_command_statuses &&
- c$smb_state$current_cmd$command !in SMB::deferred_logging_cmds )
- {
- Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
- }
- delete c$smb_state$pending_cmds[hdr$mid];
- }
+ if ( is_orig )
+ return;
+
+ delete c$smb_state$pending_cmds[hdr$mid];
}
@@ -325,18 +318,3 @@ event smb_pipe_request(c: connection, hdr: SMB1::Header, op_num: count)
c$smb_state$current_cmd$argument = arg;
}
-
-event smb1_error(c: connection, hdr: SMB1::Header, is_orig: bool)
- {
- if ( ! is_orig )
- {
- # This is for deferred commands only.
- # The more specific messages won't fire for errors
- if ( SMB::write_cmd_log &&
- c$smb_state$current_cmd$status !in SMB::ignored_command_statuses &&
- c$smb_state$current_cmd$command in SMB::deferred_logging_cmds )
- {
- Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
- }
- }
- }
diff --git a/scripts/base/protocols/smb/smb2-main.bro b/scripts/base/protocols/smb/smb2-main.bro
index 2411502815..ab453f8829 100644
--- a/scripts/base/protocols/smb/smb2-main.bro
+++ b/scripts/base/protocols/smb/smb2-main.bro
@@ -65,25 +65,16 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=-5
{
- # Is this a response?
- if ( !is_orig )
- {
- # If the command that is being looked at right now was
- # marked as PENDING, then we'll skip all of this and wait
- # for a reply that isn't marked pending.
- if ( c$smb_state$current_cmd$status == "PENDING" )
- {
- return;
- }
+ if ( is_orig )
+ return;
- if ( SMB::write_cmd_log &&
- c$smb_state$current_cmd$status !in SMB::ignored_command_statuses &&
- c$smb_state$current_cmd$command !in SMB::deferred_logging_cmds )
- {
- Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
- }
- delete c$smb_state$pending_cmds[hdr$message_id];
- }
+ # If the command that is being looked at right now was
+ # marked as PENDING, then we'll skip all of this and wait
+ # for a reply that isn't marked pending.
+ if ( c$smb_state$current_cmd$status == "PENDING" )
+ return;
+
+ delete c$smb_state$pending_cmds[hdr$message_id];
}
event smb2_negotiate_request(c: connection, hdr: SMB2::Header, dialects: index_vec) &priority=5
diff --git a/scripts/policy/protocols/smb/log-cmds.bro b/scripts/policy/protocols/smb/log-cmds.bro
new file mode 100644
index 0000000000..6890535c3b
--- /dev/null
+++ b/scripts/policy/protocols/smb/log-cmds.bro
@@ -0,0 +1,82 @@
+##! Load this script to generate an SMB command log, smb_cmd.log.
+##! This is primarily useful for debugging.
+
+@load base/protocols/smb
+
+module SMB;
+
+export {
+ redef enum Log::ID += {
+ CMD_LOG,
+ };
+
+ ## The server response statuses which are *not* logged.
+ const ignored_command_statuses: set[string] = {
+ "MORE_PROCESSING_REQUIRED",
+ } &redef;
+}
+
+## Internal use only.
+## Some commands shouldn't be logged by the smb1_message event.
+const deferred_logging_cmds: set[string] = {
+ "NEGOTIATE",
+ "READ_ANDX",
+ "SESSION_SETUP_ANDX",
+ "TREE_CONNECT_ANDX",
+};
+
+event bro_init() &priority=5
+ {
+ Log::create_stream(SMB::CMD_LOG, [$columns=SMB::CmdInfo, $path="smb_cmd"]);
+ }
+
+event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=-5
+ {
+ if ( is_orig )
+ return;
+
+ if ( c$smb_state$current_cmd$status in SMB::ignored_command_statuses )
+ return;
+
+ if ( c$smb_state$current_cmd$command in SMB::deferred_logging_cmds )
+ return;
+
+ Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
+ }
+
+event smb1_error(c: connection, hdr: SMB1::Header, is_orig: bool)
+ {
+ if ( is_orig )
+ return;
+
+ # This is for deferred commands only.
+ # The more specific messages won't fire for errors
+
+ if ( c$smb_state$current_cmd$status in SMB::ignored_command_statuses )
+ return;
+
+ if ( c$smb_state$current_cmd$command !in SMB::deferred_logging_cmds )
+ return;
+
+ Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
+ }
+
+event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=-5
+ {
+ if ( is_orig )
+ return;
+
+ # If the command that is being looked at right now was
+ # marked as PENDING, then we'll skip all of this and wait
+ # for a reply that isn't marked pending.
+ if ( c$smb_state$current_cmd$status == "PENDING" )
+ return;
+
+ if ( c$smb_state$current_cmd$status in SMB::ignored_command_statuses )
+ return;
+
+ if ( c$smb_state$current_cmd$command in SMB::deferred_logging_cmds )
+ return;
+
+ Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
+ }
diff --git a/scripts/test-all-policy.bro b/scripts/test-all-policy.bro
index e0268a7c62..7bdd2d4997 100644
--- a/scripts/test-all-policy.bro
+++ b/scripts/test-all-policy.bro
@@ -80,6 +80,7 @@
@load protocols/modbus/track-memmap.bro
@load protocols/mysql/software.bro
@load protocols/rdp/indicate_ssl.bro
+@load protocols/smb/log-cmds.bro
@load protocols/smtp/blocklists.bro
@load protocols/smtp/detect-suspicious-orig.bro
@load protocols/smtp/entities-excerpt.bro
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index 0fadde65a5..20e01df16f 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -213,7 +213,6 @@
0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
-0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::CMD_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_cmd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
@@ -260,7 +259,6 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (RFB::LOG, [columns=, ev=RFB::log_rfb, path=rfb])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Reporter::LOG, [columns=, ev=, path=reporter])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (SIP::LOG, [columns=, ev=SIP::log_sip, path=sip])) ->
-0.000000 MetaHookPost CallFunction(Log::__create_stream, , (SMB::CMD_LOG, [columns=, ev=, path=smb_cmd])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (SMB::FILES_LOG, [columns=, ev=, path=smb_files])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (SMB::MAPPING_LOG, [columns=, ev=, path=smb_mapping])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (SMTP::LOG, [columns=, ev=SMTP::log_smtp, path=smtp])) ->
@@ -276,7 +274,7 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1534455885.275568, node=bro, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1534522064.090237, node=bro, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Config::LOG)) ->
@@ -308,7 +306,6 @@
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (RFB::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Reporter::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (SIP::LOG)) ->
-0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (SMB::CMD_LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (SMB::FILES_LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (SMB::MAPPING_LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (SMTP::LOG)) ->
@@ -355,7 +352,6 @@
0.000000 MetaHookPost CallFunction(Log::add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
-0.000000 MetaHookPost CallFunction(Log::add_filter, , (SMB::CMD_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
0.000000 MetaHookPost CallFunction(Log::add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}])) ->
@@ -402,7 +398,6 @@
0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (RFB::LOG, default)) ->
0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (Reporter::LOG, default)) ->
0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (SIP::LOG, default)) ->
-0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (SMB::CMD_LOG, default)) ->
0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (SMB::FILES_LOG, default)) ->
0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (SMB::MAPPING_LOG, default)) ->
0.000000 MetaHookPost CallFunction(Log::add_stream_filters, , (SMTP::LOG, default)) ->
@@ -449,7 +444,6 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, , (RFB::LOG, [columns=, ev=RFB::log_rfb, path=rfb])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (Reporter::LOG, [columns=, ev=, path=reporter])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (SIP::LOG, [columns=, ev=SIP::log_sip, path=sip])) ->
-0.000000 MetaHookPost CallFunction(Log::create_stream, , (SMB::CMD_LOG, [columns=, ev=, path=smb_cmd])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (SMB::FILES_LOG, [columns=, ev=, path=smb_files])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (SMB::MAPPING_LOG, [columns=, ev=, path=smb_mapping])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (SMTP::LOG, [columns=, ev=SMTP::log_smtp, path=smtp])) ->
@@ -465,7 +459,7 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1534455885.275568, node=bro, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1534522064.090237, node=bro, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) ->
0.000000 MetaHookPost CallFunction(NetControl::init, , ()) ->
0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) ->
@@ -1042,7 +1036,6 @@
0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
-0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::CMD_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_cmd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
@@ -1089,7 +1082,6 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (RFB::LOG, [columns=, ev=RFB::log_rfb, path=rfb]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Reporter::LOG, [columns=, ev=, path=reporter]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (SIP::LOG, [columns=, ev=SIP::log_sip, path=sip]))
-0.000000 MetaHookPre CallFunction(Log::__create_stream, , (SMB::CMD_LOG, [columns=, ev=, path=smb_cmd]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (SMB::FILES_LOG, [columns=, ev=, path=smb_files]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (SMB::MAPPING_LOG, [columns=, ev=, path=smb_mapping]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (SMTP::LOG, [columns=, ev=SMTP::log_smtp, path=smtp]))
@@ -1105,7 +1097,7 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1534455885.275568, node=bro, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1534522064.090237, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Config::LOG))
@@ -1137,7 +1129,6 @@
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (RFB::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Reporter::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (SIP::LOG))
-0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (SMB::CMD_LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (SMB::FILES_LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (SMB::MAPPING_LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (SMTP::LOG))
@@ -1184,7 +1175,6 @@
0.000000 MetaHookPre CallFunction(Log::add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
-0.000000 MetaHookPre CallFunction(Log::add_filter, , (SMB::CMD_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=anonymous-function, interv=0 secs, postprocessor=, config={}]))
0.000000 MetaHookPre CallFunction(Log::add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=, path_func=, include=, exclude=