Commit graph

30 commits

Author SHA1 Message Date
Bernhard Amann
c664c40ac2 now the writer supports tables and vectors.
still not tested, but using Log::default_writer=Log::WRITER_SQLITE seems to generate all
the right log-databases, etc.
2012-06-14 15:54:22 -07:00
Robin Sommer
da34266a52 Switching default DS compression to gzip. 2012-05-25 08:36:59 -07:00
Robin Sommer
7cc863c5fc Fix for when not producing local output; that hung.
* origin/topic/robin/dataseries:
  Moving trace for rotation test into traces directory.
  Fixing a rotation race condition at termination.
  Portability fixes.
  Extending DS docs with some examples.
  Updating doc.
  Fixing pack_scale and time-as-int.
  Adding format specifier to DS spec to print out double as %.6f.
  DataSeries updates and fixes.
  DataSeries tuning.
  Tweaking DataSeries support.
  Extending log post-processor call to include the name of the writer.
  Removing an unnecessary const cast.
  DataSeries TODO list with open issues/questions.
  Starting DataSeries HowTo.
  Additional test output canonification for ds2txt's timestamps.
  In threads, an internal error now immediately aborts.
  DataSeries cleanup.
  Working on DataSeries support.
  Merging in DataSeries support from topic/gilbert/logging.
  Fixing  threads' DoFinish() method.
2012-05-17 12:38:47 -07:00
Robin Sommer
18aa41c62b Extending log post-processor call to include the name of the writer. 2012-04-19 10:41:01 -07:00
Robin Sommer
7131feefbc Working on DataSeries support.
- The option to use integers insteads of double was ignored.

   - Renaming script-level options to remove the ds_ prefix.

   - Log rotation didn't work.

   - A set of simple unit tests.
2012-04-09 17:46:56 -07:00
Robin Sommer
952b6b293a Merging in DataSeries support from topic/gilbert/logging.
I copied the code over manually, no merging, because (1) it needed to
be adapted to the new threading API, and (2) there's more stuff in the
branch that I haven't ported yet.

The DS output generally seems to work, but it has seen no further
testing yet.

Not unit tests yet either.
2012-04-03 22:14:56 -07:00
Robin Sommer
3d2dc5f5fc Merge remote-tracking branch 'origin/topic/script-reference'
* origin/topic/script-reference: (50 commits)
  A few updates for the FAQ.
  Fixing some doc warnings.
  Forgot to add protocol identifier support for TLS 1.2
  Finished SSL & syslog autodocs.
  Adding the draft SSL extension type next_protocol_negotiation.
  Fix some documentation errors.
  Tweaks.
  A set of script-reference polishing.
  fixed a couple typos in comments
  Add summary documentation to bif files.
  Add ssl and syslog script documentation
  Add Conn and DNS protocol script documentation. (fixes #731)
  Small updates to the default local.bro.
  Documentation updates for HTTP & IRC scripts.
  SSH&FTP Documentation updates.
  Fixing a warning from the documentation generation.
  This completes framework documentation package 4.
  Minor notice documentation tweaks.
  Fix some malformed Broxygen xref roles.
  Minor doc tweaks to init-bare.bro.
  ...

Conflicts:
	aux/broccoli
	aux/broctl
	src/bro.bif
	src/strings.bif

Includes:

    - Updated baselines for autodoc tests.
    - Now excluding stats.bro from external texts, it's not stable.
2012-01-10 14:00:44 -08:00
Jon Siwek
f921a4d5db Change SFTP/SCP log rotators to use 4-digit year in filenames (fixes #745). 2012-01-10 09:38:17 -06:00
Jon Siwek
e7cf347288 Add SFTP log postprocessor that transfers logs to remote hosts.
Addresses #737
2012-01-06 14:58:17 -06:00
Jon Siwek
a4117016e9 Merge branch 'master' into topic/script-reference
Conflicts:
	aux/broccoli
	aux/broctl
	scripts/base/frameworks/notice/main.bro
	src/event.bif
2011-12-19 16:17:58 -06:00
Robin Sommer
c81477d9d3 Executive decision: empty fields are now logged as "(empty)" by default. 2011-12-19 08:49:30 -08:00
Jon Siwek
1f57827e54 Add more logging framework documentation. 2011-12-09 14:30:21 -06:00
Jon Siwek
a71ab223c4 Various unit test cleanup.
Updated README and collected coverage-related tests in a common dir.

There are still coverage failures resulting from either the following
scripts not being @load'd in the default bro mode:

base/frameworks/time-machine/notice.bro
base/protocols/http/partial-content.bro
base/protocols/rpc/main.bro

Or the following result in errors when @load'd:

policy/protocols/conn/scan.bro
policy/hot.conn.bro

If these are all scripts-in-progress, can we move them all to live
outside the main scripts/ directory until they're ready?
2011-09-27 12:41:30 -05:00
Robin Sommer
fc491c087b Merge branch 'master', remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix PktSrc setting next_timestamp even when no packet available
  Fix lack of NUL-termination in to_upper/to_lower BIF's return val.
  Fixing unit tests and some minor bugs.
  Fix broctl cluster log rotation (addresses #619)

* master:
2011-09-22 19:04:54 -07:00
Jon Siwek
928baf4b66 Fix lack of NUL-termination in to_upper/to_lower BIF's return val. 2011-09-22 13:56:16 -05:00
Jon Siwek
d2118200ea Fixing unit tests and some minor bugs. 2011-09-22 12:42:16 -05:00
Robin Sommer
62581ede31 Merge remote-tracking branch 'origin/topic/jsiwek/filter-rotation'
* origin/topic/jsiwek/filter-rotation:
  Remove Log::rotation_control (addresses #572).
  Add an optional Log::RotationControl to Log::Filter records.

Closes #572.
2011-09-15 16:28:13 -07:00
Jon Siwek
fe38c22d2b Remove Log::rotation_control (addresses #572).
Log rotation is now controlled directly through Filter records.

Also addressed a TODO in the default_path_func regarding the
LogMgr::AddFilter function generating internal filter path
suggestions/fallbacks.  Now, if the user doesn't explicitly set a filter
path, the filter's path will be the result of the first call to
default_path_func (happens during the first write to the log).  And in
that case the path suggestion argument to the path_func is an empty
string.
2011-09-08 15:00:31 -05:00
Jon Siwek
d8c716ae17 Merge branch 'master' into topic/jsiwek/filter-rotation 2011-09-08 13:01:00 -05:00
Jon Siwek
d2bf33ee19 Merge branch 'master' into topic/jsiwek/filter-rotation 2011-09-07 12:30:47 -05:00
Jon Siwek
80e154ba3c Various changes to documentation framework.
- Reorganize top-level 'doc' Makefile target so submodules can easily
  add their own doc-generating routines to it.  e.g. the Bro project
  makes a placeholder 'doc' target, then adds 'restdoc', 'sphinxdoc';
  later Broccoli can add it's own target as a dependency for generating
  API docs.

- Fixed generated docs for BIFs not being organized under a base/
  subdirectory like the original source files.

- Fixed documentation style for function parameters not applying to
  functions declared as record fields.

- Misc. script documentation tweaks to address warnings given by Sphinx.
2011-09-07 10:02:15 -05:00
Robin Sommer
630c256a72 Merge remote branch 'origin/topic/gilbert/ascii-header'
* origin/topic/gilbert/ascii-header:
  Updated tests; removed net type from type conversion code.
  Updated header format (see #558)
  Header modification to LogWriterAscii to make it easier for scripts to understand bro log files.

Notes:

    - I've refactored the code a bit, also adapting the style a bit.
      Also edited the header format slightly.

    - I'm skipping the testing/btest/profiles directory, which seems
      unrelated.

    - I'm also skipping the baseline updates as they weren't
      up-to-date anymore. Will update them in a subsequent commit.
2011-09-04 12:12:08 -07:00
Seth Hall
11c437faa3 Logging framework update and mass Log::ID renaming.
- Log path's are generated in the scripting land
  now.  The default Log stream ID to path string
  mapping works like this:
    - Notice::LOG -> "notice"
    - Notice::POLICY_LOG -> "notice_policy"
    - TestModule::LOG -> "test_module"

- Logging streams updated across all of the shipped
  scripts to be more user friendly.  Instead of
  the logging stream ID HTTP::HTTP, we now have
  HTTP::LOG, etc.

- The priorities on some bro_init handlers have
  been adjusted to make the process of applying
  filters or disabling streams easier for users.
2011-09-03 01:10:17 -04:00
Jon Siwek
c8b2698754 Add a log postprocessing function that can SCP rotated logs to remote hosts. 2011-08-29 12:28:38 -05:00
Jon Siwek
263ef2bfc9 Add an optional Log::RotationControl to Log::Filter records.
This allows for the RotationControl to be automatically added to the
Log::rotation_control table for the filter's (writer, path) when it is
added to a stream via Log::add_filter.  Log::remove_filter now also
removes any RotationControl's associated with the filter from the
Log::rotation_control table.
2011-08-26 14:36:56 -05:00
Jon Siwek
41dd0b98e9 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/frameworks/metrics/main.bro
	scripts/base/frameworks/notice/actions/email_admin.bro
	scripts/base/frameworks/notice/weird.bro
	scripts/base/protocols/mime/file-hash.bro
	scripts/base/protocols/mime/file-ident.bro
	scripts/policy/frameworks/communication/listen-clear.bro
	scripts/policy/frameworks/communication/listen-ssl.bro
	scripts/policy/frameworks/control/controller.bro
	scripts/policy/frameworks/metrics/http-example.bro
	scripts/policy/frameworks/metrics/ssl-example.bro
	scripts/policy/protocols/conn/scan.bro
	src/CMakeLists.txt
2011-08-15 15:34:25 -05:00
Robin Sommer
cb31fd3bb9 Logging's path_func now receives the log record as argument.
Closes #555.
2011-08-12 22:18:45 -07:00
Jon Siwek
7b07a19cd6 bro scripts generated from bifs now install to $prefix/share/bro/base/
Addresses #545
2011-08-10 19:05:03 -05:00
Robin Sommer
bbb0b855a2 Merge branch 'topic/robin/rotation-pp'
* topic/robin/rotation-pp:
  Adding a default_path_func that makes the default naming scheme script-level controlled.
  Reworking logging's postprocessor logic.

Conflicts:
	scripts/base/frameworks/logging/main.bro
	testing/btest/policy/frameworks/logging/rotate-custom.bro
2011-08-08 16:14:54 -07:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00