mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 21:48:21 +00:00
697b2748f5
This commit rewrites the way that weirds are logged and fixes a number of issues on the way. Most prominently, flow weirds now actually log information about the flow that they occur in (before this change, they only logged the name of the weird, which is only marginally helpful). Besides restructuring how weird logging works internally, weirds can now also be generated by calling Weird::weird with the info record directly, allowing more fine-granular passing of information. This is e.g. used for DNS weirds, which do not have the connection record available any more when they are generated (before data like the connection ID was just not logged in these instances). Addresses BIT-1578
12 lines
587 B
Text
12 lines
587 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path weird
|
|
#open 2016-06-15-20-29-41
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
|
|
#types time string addr port addr port string string bool string
|
|
1363716396.798286 CXWv6p3arKYeMETxOg 55.247.223.174 27285 222.195.43.124 53 DNS_RR_unknown_type 46 F bro
|
|
1363716396.798374 CXWv6p3arKYeMETxOg 55.247.223.174 27285 222.195.43.124 53 dns_unmatched_reply - F bro
|
|
1363716396.798374 CXWv6p3arKYeMETxOg 55.247.223.174 27285 222.195.43.124 53 dns_unmatched_msg - F bro
|
|
#close 2016-06-15-20-29-41
|