Commit graph

11 commits

Author SHA1 Message Date
Jon Siwek
f41f392743 Improve input framework re-read logic
Changed from checking for "has newer modification time" to "has
different modification time or inode number".
2018-08-24 12:46:31 -05:00
Robin Sommer
7826cbdfb6 Fixing couple issues reported by Coverity. 2017-04-08 09:57:45 -07:00
Johanna Amann
a38f44b1fd Fix coverity warning in Ascii reader. 2017-03-13 11:16:15 -07:00
Johanna Amann
b6e6302b40 Ascii reader error changes - fix small bugs
The changes are now a bit more succinct with less code changes required.
Behavior is tested a little bit more thoroughly and a memory problem
when reading incomplete lines was fixed. ReadHeader also always directly
returns if header reading failed.

Error messages now are back to what they were before the change, if the
new behavior is not used.

I also tweaked the documentation text a bit.
2017-03-03 12:42:44 -08:00
Seth Hall
75744d22bc Input's ascii reader is now more resilient.
By default, the ASCII reader does not fail on errors anymore.
If there is a problem parsing a line, a reporter warning is
written and parsing continues.  If the file is missing or can't
be read, the input thread just tries again on the next heartbeat.

Options have been added to recreate the previous behavior...

const InputAscii::fail_on_invalid_lines: bool;
and
const InputAscii::fail_on_file_problem: bool;

They are both set to `F` by default which makes the input readers
resilient to failure.
2017-02-23 23:13:12 -05:00
Seth Hall
2b15ec1069 Another resilient Ascii reader checkpoint.
This works correctly now (as a prototype at least). If a file
disappears, the thread complains once and once the file reappears
the thread will once again begin watching it.
2017-02-21 23:35:29 -05:00
Seth Hall
b0d812812f In progress on ascii writer behavior change. 2017-02-21 15:45:26 -05:00
Johanna Amann
6b9abe85a7 Add error events to input framework.
This change introduces error events for Table and Event readers. Users
can now specify an event that is called when an info, warning, or error
is emitted by their input reader. This can, e.g., be used to raise
notices in case errors occur when reading an important input stream.

Example:

event error_event(desc: Input::TableDescription, msg: string, level: Reporter::Level)
	{
	...
	}

event bro_init()
	{
	Input::add_table([$source="a", $error_ev=error_event, ...]);
	}

For the moment, this converts all errors in the Asciiformatter into
warnings (to show that they are non-fatal) - the Reader itself also has
to throw an Error to show that a fatal error occurred and processing
will be abort.

It might be nicer to change this and require readers to mark fatal
errors as such when throwing them.

Addresses BIT-1181
2016-07-22 19:45:28 -07:00
Robin Sommer
58dea28504 Merge remote-tracking branch 'origin/topic/johanna/windows-newlines'
(Added a double-check that line isn't completely empty.)

BIT-1198 #merged

* origin/topic/johanna/windows-newlines:
  Ascii Input: Accept dos/windows newlines.
2016-06-06 18:14:21 -07:00
Johanna Amann
e8418ad5b0 Ascii Input: Accept dos/windows newlines.
The ascii reader now accepts \r\n newlines without complaining.
Furthermore, the reader was slightly rewritten in a more c++11-y way,
removing all raw pointers from the class.

Addresses BIT-1198
2016-06-01 11:21:44 -07:00
Robin Sommer
f4cbcb9b03 Converting log writers and input readers to plugins. 2014-07-20 19:17:58 +02:00
Renamed from src/input/readers/Ascii.cc (Browse further)