Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Remove Log::rotation_control (addresses #572).

Browse source 
Log rotation is now controlled directly through Filter records.

Also addressed a TODO in the default_path_func regarding the
LogMgr::AddFilter function generating internal filter path
suggestions/fallbacks.  Now, if the user doesn't explicitly set a filter
path, the filter's path will be the result of the first call to
default_path_func (happens during the first write to the log).  And in
that case the path suggestion argument to the path_func is an empty
string.
This commit is contained in:
Jon Siwek 2011-09-08 14:46:17 -05:00
parent d8c716ae17
commit fe38c22d2b
11 changed files with 73 additions and 291 deletions
Download patch file Download diff file Expand all files Collapse all files

18
scripts/base/frameworks/notice/main.bro
View file

@ -215,18 +215,6 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool
return T;
}
# This extra export section here is just because this redefinition should
# be documented as part of the "public API" of this script, but the redef
# needs to occur after the postprocessor function implementation.
export {
## By default, an ASCII version of the the alarm log is emailed daily to any
## configured :bro:id:`Notice::mail_dest` if not operating on trace files.
redef Log::rotation_control += {
[Log::WRITER_ASCII, "alarm-mail"] =
[$interv=24hrs, $postprocessor=log_mailing_postprocessor]
};
}
event bro_init() &priority=5
{
Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice]);
@ -237,9 +225,9 @@ event bro_init() &priority=5
# Make sure that this alarm log is also output as text so that it can
# be packaged up and emailed later.
if ( ! reading_traces() && mail_dest != "" )
Log::add_filter(Notice::ALARM_LOG, [$name="alarm-mail",
$path="alarm-mail",
$writer=Log::WRITER_ASCII]);
Log::add_filter(Notice::ALARM_LOG,
[$name="alarm-mail", $path="alarm-mail", $writer=Log::WRITER_ASCII,
$interv=24hrs, $postprocessor=log_mailing_postprocessor]);
}
# TODO: fix this.