mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
35827eeb31
The generation of weird events, by default, are now rate-limited according to these tunable options: - Weird::sampling_whitelist - Weird::sampling_threshold - Weird::sampling_rate - Weird::sampling_duration The new get_reporter_stats() BIF also allows one to query the total number of weirds generated (pre-sampling) which the new policy/misc/weird-stats.bro script uses periodically to populate a weird_stats.log. There's also new reporter BIFs to allow generating weirds from the script-layer such that they go through the same, internal rate-limiting/sampling mechanisms: - Reporter::conn_weird - Reporter::flow_weird - Reporter::net_weird Some of the code was adapted from previous work by Johanna Amann.
32 lines
562 B
Text
32 lines
562 B
Text
# @TEST-EXEC: btest-bg-run bro bro %INPUT
|
|
# @TEST-EXEC: btest-bg-wait 20
|
|
# @TEST-EXEC: btest-diff bro/weird_stats.log
|
|
|
|
@load misc/weird-stats.bro
|
|
|
|
redef exit_only_after_terminate = T;
|
|
redef WeirdStats::weird_stat_interval = 5sec;
|
|
|
|
event die()
|
|
{
|
|
terminate();
|
|
}
|
|
|
|
event gen_weirds(n: count, done: bool &default = F)
|
|
{
|
|
while ( n != 0 )
|
|
{
|
|
Reporter::net_weird("my_weird");
|
|
--n;
|
|
}
|
|
|
|
if ( done )
|
|
schedule 5sec { die() };
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
event gen_weirds(1000);
|
|
schedule 7.5sec { gen_weirds(2000) } ;
|
|
schedule 12.5sec { gen_weirds(10, T) } ;
|
|
}
|