Commit graph

427 commits

Author SHA1 Message Date
Seth Hall
601d1cf37e Merge remote-tracking branch 'origin/master' into topic/seth/elasticsearch
Conflicts:
	aux/binpac
	aux/bro-aux
	aux/broccoli
	aux/broctl
	scripts/base/frameworks/logging/__load__.bro
	src/logging.bif
2012-07-06 12:01:16 -04:00
Robin Sommer
acb6c0a0a5 Merge branch 'robin/topic/writer-info'
* robin/topic/writer-info:
  Bugfix. Using a custom rotate function was broken.
2012-07-02 16:59:56 -07:00
Robin Sommer
d26a96bd47 Bugfix. Using a custom rotate function was broken. 2012-07-02 16:57:16 -07:00
Robin Sommer
3fcece44cb Tiny bugfix for returning writer name. 2012-07-02 16:36:09 -07:00
Robin Sommer
ff73f3a040 Fixing merge relicts. 2012-07-02 16:11:42 -07:00
Robin Sommer
06d2fd52bd Merge remote-tracking branch 'origin/topic/bernhard/reader-info'
* origin/topic/bernhard/reader-info:
  fix small bug - now configuration actually is passed.
  add mode to readerinfo - no need to have it separately everywhere anymore.
  introduce reader-info struct analogous to writer-info.
  Introduce support for a table of key/value pairs with further configuration options, with the same userinterface as in the logging interface.
  make writer-info work when debugging is enabled

Conflicts:
	testing/btest/Baseline/scripts.base.frameworks.input.event/out
	testing/btest/Baseline/scripts.base.frameworks.input.executeraw/out
	testing/btest/Baseline/scripts.base.frameworks.input.raw/out
	testing/btest/Baseline/scripts.base.frameworks.input.rereadraw/out
	testing/btest/Baseline/scripts.base.frameworks.input.tableevent/out

Closes #841.
2012-07-02 15:33:08 -07:00
Robin Sommer
90763bb2f2 Merge branch 'robin/topic/writer-info'
* robin/topic/writer-info:
  Extending the log writer DoInit() API.
  Reworking log writer API to make it easier to pass additional information to a writer's initialization method.

Conflicts:
	src/logging/WriterBackend.cc
	src/logging/WriterBackend.h
	src/logging/WriterFrontend.cc
2012-07-02 15:20:37 -07:00
Robin Sommer
9183309482 Merge remote-tracking branch 'origin/topic/bernhard/input-crash-search'
* origin/topic/bernhard/input-crash-search:
  for bug-searching:

Closes #840
2012-07-02 15:10:27 -07:00
Robin Sommer
9f6cf1ad90 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix inconsistencies in random number generation.
  Updating input framework unit tests.
  Add front-end name to InitMessage from WriterFrontend to Backend.
  Small tweak to make test complete quicker.
  Drain events before terminating log/thread managers.
  Fix strict-aliasing warning in RemoteSerializer.cc (fixes #834).
  Fix typos in event documentation
  Fix typos in NEWS for Bro 2.1 beta
2012-07-02 14:51:31 -07:00
Bernhard Amann
b8ad4567fb Merge branch 'topic/bernhard/reader-info' into topic/bernhard/sqlite
Now uses optional dbname configuration option

Conflicts:
	scripts/base/frameworks/logging/__load__.bro
	src/logging.bif
2012-07-02 10:13:54 -07:00
Bernhard Amann
227159fd04 make writer-info work when debugging is enabled 2012-06-28 15:08:35 -07:00
Jon Siwek
41f1544332 Add front-end name to InitMessage from WriterFrontend to Backend.
At the time WriterBackend::Init() happens, it's in a different thread
than its frontend member, but tried to access it directly to get its
name, that info is now sent in the InitMessage instead.

(Problem was observed segfaulting the unit test
scripts.base.frameworks.notice.mail-alarms on Ubuntu 12.04).
2012-06-28 15:48:03 -05:00
Bernhard Amann
c7338a0731 for bug-searching:
set frontend type before starting the thread. This means that the thread type will be output correctly in the error message.

return errno string of pthread functions called in thread start
2012-06-25 14:54:15 -07:00
Robin Sommer
19eea409c3 Extending the log writer DoInit() API.
We now pass in a Info struct that contains:

    - the path name (as before)
    - the rotation interval
    - the log_rotate_base_time in seconds
    - a table of key/value pairs with further configuration options.

To fill the table, log filters have a new field "config: table[string]
of strings". This gives a way to pass arbitrary values from
script-land to writers. Interpretation is left up to the writer.

Also splits calc_next_rotate() into two functions, one of which is
thread-safe and can be used with the log_rotate_base_time value from
DoInit().

Includes also updates to the None writer:

    - It gets its own script writers/none.bro.

    - New bool option LogNone::debug to enable debug output. It then
      prints out all the values passed to DoInit(). That's used by a
      btest test to ensure the new DoInit() values are right.

    - Fixed a bug that prevented Bro from terminating..

(scripts.base.frameworks.logging.rotate-custom currently fails.
Haven't yet investigated why.)
2012-06-21 17:42:33 -07:00
Robin Sommer
b38d1e1ec2 Reworking log writer API to make it easier to pass additional
information to a writer's initialization method.

However, for now the information provided is still the same.
2012-06-21 11:57:45 -07:00
Seth Hall
7fc96a8c0f Adding a define to make the stdint C macros available. 2012-06-18 15:49:00 -04:00
Seth Hall
95f4390cb6 Adding an extra header. 2012-06-18 02:03:43 -04:00
Seth Hall
52ceee8c86 Fixed a bug with messed up time value passing to elasticsearch. 2012-06-18 01:31:52 -04:00
Seth Hall
cb7eac212e Small updates and a little standardization for config.h.in naming. 2012-06-17 22:55:11 -04:00
Seth Hall
57980c86e6 Bug fixes.
- The curl handle is now cleaned up correctly.

- Interval values are now treated as doubles.  Treating them as uint64_t
  was wrong because intervals can be negative.  There is also no obvious
  benefit in elasticsearch to converting the value to milliseconds.
2012-06-17 21:41:29 -04:00
Seth Hall
cd8169dda3 Bug fix and feature.
- Fixed bug with how data is sent to elasticsearch.

- Added a feature to only allow data of a certain
  size to be buffered before sending to the
  elasticsearch server.  Configured with the
  LogElasticSearch::max_byte_size variable.
2012-06-16 22:22:40 -04:00
Seth Hall
b1561437e9 Forgot to call the parent method for DoHeartBeat. 2012-06-16 00:35:40 -04:00
Seth Hall
8334dceadb Changed the escaping method. 2012-06-15 22:19:51 -04:00
Seth Hall
ca5eb5382a Flush logs to ES daemon as Bro is shutting down. 2012-06-15 21:06:06 -04:00
Seth Hall
a4df914ab7 Reduce the batch size to 1000 and add a maximum time interval for batches. 2012-06-15 20:53:09 -04:00
Seth Hall
0bb8b69c95 Reworked bulk operation string construction to use ODesc and added json escaping. 2012-06-15 16:30:54 -04:00
Vlad Grigorescu
93a7a46af0 Merge branch 'master' of git://git.bro-ids.org/bro into elasticsearch 2012-06-15 10:46:48 -04:00
Bernhard Amann
c664c40ac2 now the writer supports tables and vectors.
still not tested, but using Log::default_writer=Log::WRITER_SQLITE seems to generate all
the right log-databases, etc.
2012-06-14 15:54:22 -07:00
Bernhard Amann
0a439b6b61 Merge remote-tracking branch 'origin/master' into topic/bernhard/sqlite 2012-06-14 15:15:58 -07:00
Bernhard Amann
6e0d15b55e basic sqlite writer seems to work.
does not support table and vector types because SQLite has no support for arrays.
also does not support rotation, etc.

Not really tested thoroughly - but starting bro with Log::default_writer=Log::WRITER_SQLITE
yields a couple of sqlite files that seem to contain sensible stuff.
2012-06-11 11:43:06 -07:00
Jon Siwek
e9c18b51a3 Add more error handling code to logging of enum vals. (addresses #829)
If lookup of enum name by value fails, an error is now sent through
the reporter framework and the value logged will be an empty string
(as opposed to trying to construct a string with null pointer which
throws a logic_error and aborts Bro).
2012-06-08 10:11:54 -05:00
Vlad Grigorescu
5e05e548ff Change time printf format to use the more compatible PRIu64. 2012-06-05 23:20:28 -04:00
Vlad Grigorescu
894dec0069 No quotes for times and doubles, since ES won't interpret them as numbers then. 2012-06-05 23:01:36 -04:00
Vlad Grigorescu
5db027e39f Fix timestamp overflow bug. 2012-06-05 17:23:50 -04:00
Vlad Grigorescu
7bee0b0d8e Added sending messages to ElasticSearch over HTTP. 2012-06-03 22:07:20 -04:00
Vlad Grigorescu
95f000738b ElasticSearch log writer implementation test 1 - writes out JSON to file instead of sending it over HTTP for now. 2012-06-03 12:40:09 -04:00
Robin Sommer
61ce9b5412 Checkpoint - all src/ except src/input 2012-05-25 14:05:50 -07:00
Jon Siwek
5f3575425d Fix compile errors.
Preprocess out DataSeries.cc based on config.h's USE_DATASERIES value
and one reference to threading::Field needed scoping.
2012-05-17 15:26:28 -05:00
Robin Sommer
7cc863c5fc Fix for when not producing local output; that hung.
* origin/topic/robin/dataseries:
  Moving trace for rotation test into traces directory.
  Fixing a rotation race condition at termination.
  Portability fixes.
  Extending DS docs with some examples.
  Updating doc.
  Fixing pack_scale and time-as-int.
  Adding format specifier to DS spec to print out double as %.6f.
  DataSeries updates and fixes.
  DataSeries tuning.
  Tweaking DataSeries support.
  Extending log post-processor call to include the name of the writer.
  Removing an unnecessary const cast.
  DataSeries TODO list with open issues/questions.
  Starting DataSeries HowTo.
  Additional test output canonification for ds2txt's timestamps.
  In threads, an internal error now immediately aborts.
  DataSeries cleanup.
  Working on DataSeries support.
  Merging in DataSeries support from topic/gilbert/logging.
  Fixing  threads' DoFinish() method.
2012-05-17 12:38:47 -07:00
Robin Sommer
5dae925f67 Fixing a rotation race condition at termination.
Noticed with DS, but could just as well happen with ASCII.
2012-05-16 18:24:55 -07:00
Robin Sommer
99db264775 Portability fixes.
- Fix for time-as-int on 32-bit systems.

    - Skipping ds2txt's index output for test diffing, as it seems
      non-portable.
2012-05-16 18:01:28 -07:00
Robin Sommer
be6567f437 Merge remote-tracking branch 'origin/master' into topic/robin/dataseries 2012-05-14 22:17:26 -07:00
Robin Sommer
fabe891d4f Fixing pack_scale and time-as-int.
Also removing now unneccessary canonifier script, and updating test
baselines.
2012-05-14 22:04:57 -07:00
Robin Sommer
00b592f933 Adding format specifier to DS spec to print out double as %.6f. 2012-05-14 21:38:27 -07:00
Jon Siwek
905e4d3a14 Change IPv6 output format to no longer automatically be bracketed.
Instead, the `addr_to_uri` script-level function can be used to
explicitly add brackets to an address if it's IPv6 and will be
included in a URI or when a ":<port>" needs to be appended to it.
2012-05-07 12:55:54 -05:00
Robin Sommer
a0575158ef DataSeries updates and fixes. 2012-05-04 21:58:39 -07:00
Jon Siwek
5984564946 Change IPv6 address/prefix output format to be bracketed.
Also add a test case for content extraction.
2012-05-04 11:21:18 -05:00
Robin Sommer
c91563fe75 DataSeries tuning.
- Now using the new DS interface from git to remove warning.

- New leak tests, not yet tried,
2012-04-24 17:57:05 -07:00
Robin Sommer
4b70adcb4b Tweaking DataSeries support. 2012-04-19 10:42:09 -07:00
Robin Sommer
1fba55f4f3 Removing an unnecessary const cast. 2012-04-18 14:59:42 -07:00