Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Remove Log::rotation_control (addresses #572).

Browse source 
Log rotation is now controlled directly through Filter records.

Also addressed a TODO in the default_path_func regarding the
LogMgr::AddFilter function generating internal filter path
suggestions/fallbacks.  Now, if the user doesn't explicitly set a filter
path, the filter's path will be the result of the first call to
default_path_func (happens during the first write to the log).  And in
that case the path suggestion argument to the path_func is an empty
string.
This commit is contained in:
Jon Siwek 2011-09-08 14:46:17 -05:00
parent d8c716ae17
commit fe38c22d2b
11 changed files with 73 additions and 291 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/frameworks/control/main.bro
View file

@ -49,8 +49,6 @@ export {
## Variable IDs that are to be ignored by the update process.
const ignore_ids: set[string] = {
# FIXME: Bro crashes if it tries to send this ID.
"Log::rotation_control",
};
## Event for requesting the value of an ID (a variable).

43
scripts/base/frameworks/logging/main.bro
View file

@ -32,8 +32,10 @@ export {
## to derive a name.
##
## id: The log stream.
## path: A suggested path value, which may be either the filter's ``path``
## if defined or a fall-back generated internally.
## path: A suggested path value, which may be either the filter's
## ``path`` if defined, else a previous result from the function.
## If no ``path`` is defined for the filter, then the first call
## to the function will contain an empty string.
## rec: An instance of the streams's ``columns`` type with its
## fields set to the values to logged.
##
@ -65,20 +67,6 @@ export {
## table are initialized by each writer type.
const default_rotation_postprocessors: table[Writer] of function(info: RotationInfo) : bool &redef;
## Type for controlling file rotation.
type RotationControl: record {
## Rotation interval.
interv: interval &default=default_rotation_interval;
## Callback function to trigger for rotated files. If not set, the default
## comes out of default_rotation_postprocessors.
postprocessor: function(info: RotationInfo) : bool &optional;
};
## Specifies rotation parameters per ``(id, path)`` tuple.
## If a pair is not found in this table, default values defined in
## ``RotationControl`` are used.
const rotation_control: table[Writer, string] of RotationControl &default=[] &redef;
## Filter customizing logging.
type Filter: record {
## Descriptive name to reference this filter.
@ -114,8 +102,10 @@ export {
## connection ...
##
## id: The log stream.
## path: A suggested path value, which may be either the filter's ``path``
## if defined or a fall-back generated internally.
## path: A suggested path value, which may be either the filter's
## ``path`` if defined, else a previous result from the function.
## If no ``path`` is defined for the filter, then the first call
## to the function will contain an empty string.
## rec: An instance of the streams's ``columns`` type with its
## fields set to the values to logged.
##
@ -136,10 +126,12 @@ export {
## If true, entries are passed on to remote peers.
log_remote: bool &default=enable_remote_logging;
## If set, the rotation control value is automatically added to
## :bro:id:`Log::rotation_control` for the filter's (writer, path)
## when adding the filter to a stream via :bro:id:`Log::add_filter`
rotation: RotationControl &optional;
## Rotation interval.
interv: interval &default=default_rotation_interval;
## Callback function to trigger for rotated files. If not set,
## the default comes out of default_rotation_postprocessors.
postprocessor: function(info: RotationInfo) : bool &optional;
};
## Sentinel value for indicating that a filter was not found when looked up.
@ -182,10 +174,9 @@ function default_path_func(id: ID, path: string, rec: any) : string
local parts = split1(id_str, /::/);
if ( |parts| == 2 )
{
# TODO: the core shouldn't be suggesting paths anymore. Only
# statically defined paths should be sent into here. This
# is only to cope with the core generated paths.
if ( to_lower(parts[2]) != path )
# The suggested path value is a previous result of this function
# or a filter path explicitly set by the user, so continue using it
if ( path != "" )
return path;
# Example: Notice::LOG -> "notice"

18
scripts/base/frameworks/notice/main.bro
View file

@ -215,18 +215,6 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool
return T;
}
# This extra export section here is just because this redefinition should
# be documented as part of the "public API" of this script, but the redef
# needs to occur after the postprocessor function implementation.
export {
## By default, an ASCII version of the the alarm log is emailed daily to any
## configured :bro:id:`Notice::mail_dest` if not operating on trace files.
redef Log::rotation_control += {
[Log::WRITER_ASCII, "alarm-mail"] =
[$interv=24hrs, $postprocessor=log_mailing_postprocessor]
};
}
event bro_init() &priority=5
{
Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice]);
@ -237,9 +225,9 @@ event bro_init() &priority=5
# Make sure that this alarm log is also output as text so that it can
# be packaged up and emailed later.
if ( ! reading_traces() && mail_dest != "" )
Log::add_filter(Notice::ALARM_LOG, [$name="alarm-mail",
$path="alarm-mail",
$writer=Log::WRITER_ASCII]);
Log::add_filter(Notice::ALARM_LOG,
[$name="alarm-mail", $path="alarm-mail", $writer=Log::WRITER_ASCII,
$interv=24hrs, $postprocessor=log_mailing_postprocessor]);
}
# TODO: fix this.