Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Lessen cluster node of notice suppression.

Browse source 
With this commit, the data structure that is transfered for notice
suppression is much smaller than before, not including potentially
complex data structures like the fa_file record.
This commit is contained in:
Johanna Amann 2017-05-03 13:14:20 -07:00
parent 2c2c9c9052
commit ff998dfa43
2 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/frameworks/notice/cluster.bro
View file

@ -21,10 +21,10 @@ redef Cluster::manager2worker_events += /Notice::begin_suppression/;
redef Cluster::worker2manager_events += /Notice::cluster_notice/;
@if ( Cluster::local_node_type() != Cluster::MANAGER )
event Notice::begin_suppression(n: Notice::Info)
event Notice::begin_suppression(ts: time, suppress_for: interval, note: Type, identifier: string)
{
local suppress_until = n$ts + n$suppress_for;
suppressing[n$note, n$identifier] = suppress_until;
local suppress_until = ts + suppress_for;
suppressing[note, identifier] = suppress_until;
}
@endif