mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
0c875220e9
In the past, we used a default canonifier, which removes everything that looks like a timestamp from log files. The goal of this is to prevent logs from changing, e.g., due to local system times ending up in log files. This, however, also has the side-effect of removing information that is parsed from protocols which probably should be part of our tests. There is at least one test (1999 certificates) where the entire test output was essentially removed by the canonifier. GH-4521 was similarly masked by this. This commit changes the default canonifier, so that only the first timestamp in a line is removed. This should skip timestamps that are likely to change while keeping timestamps that are parsed from protocol information. A pass has been made over the tests, with some additional adjustments for cases which require the old canonifier. There are some cases in which we probably could go further and not remove timestamps at all - that, however, seems like a follow-up project.
17 lines
1.8 KiB
Text
17 lines
1.8 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path smb_files
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size prev_name times.modified times.accessed times.created times.changed
|
|
#types time string addr port addr port string enum string string count string time time time time
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - pythonfile 16 - 1549643138.282482 1549643183.156000 1549643138.280001 1549643138.282482
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_READ - pythonfile 16 - 1549643138.282482 1549643183.156000 1549643138.280001 1549643138.282482
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 FH8ukp35vOgBQD0yi SMB::FILE_READ - pythonfile 16 - 1549643138.282482 1549643183.156000 1549643138.280001 1549643138.282482
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_WRITE - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 FZwWEMkEEYbonVSe2 SMB::FILE_WRITE - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - <share_root> 0 - 1549644186.688000 1549644187.700001 1549644186.688000 1549644186.688000
|
|
#close XXXX-XX-XX-XX-XX-XX
|