mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
53d9832d5a
This could, for example, result in duplicate emails being sent (one from manager and one from worker) if Notice::emailed_types is redef'd in local.bro (or any script that gets loaded on all cluster nodes). The problem was that Notice::policy is used to populate the internal Notice::ordered_policy vector in a priority 10 bro_init handler (in scripts/base/frameworks/notice/main.bro) and then that is what is used when applying policy to notices. In order for scripts/base/frameworks/notice/cluster.bro to prevent Notice::policy from being used on non-manager nodes, it needs to clear it in a bro_init hander of higher priority than 10.
58 lines
1.7 KiB
Text
58 lines
1.7 KiB
Text
##! Implements notice functionality across clusters. Worker nodes
|
|
##! will disable notice/alarm logging streams and forward notice
|
|
##! events to the manager node for logging/processing.
|
|
|
|
@load ./main
|
|
@load base/frameworks/cluster
|
|
|
|
module Notice;
|
|
|
|
export {
|
|
## This is the event used to transport notices on the cluster.
|
|
##
|
|
## n: The notice information to be sent to the cluster manager for
|
|
## further processing.
|
|
global cluster_notice: event(n: Notice::Info);
|
|
}
|
|
|
|
## Manager can communicate notice suppression to workers.
|
|
redef Cluster::manager2worker_events += /Notice::begin_suppression/;
|
|
## Workers needs need ability to forward notices to manager.
|
|
redef Cluster::worker2manager_events += /Notice::cluster_notice/;
|
|
|
|
@if ( Cluster::local_node_type() != Cluster::MANAGER )
|
|
# The notice policy is completely handled by the manager and shouldn't be
|
|
# done by workers or proxies to save time for packet processing.
|
|
event bro_init() &priority=11
|
|
{
|
|
Notice::policy = table();
|
|
}
|
|
|
|
event Notice::begin_suppression(n: Notice::Info)
|
|
{
|
|
suppressing[n$note, n$identifier] = n;
|
|
}
|
|
|
|
event Notice::notice(n: Notice::Info)
|
|
{
|
|
# Send the locally generated notice on to the manager.
|
|
event Notice::cluster_notice(n);
|
|
}
|
|
|
|
event bro_init() &priority=-3
|
|
{
|
|
# Workers and proxies need to disable the notice streams because notice
|
|
# events are forwarded directly instead of being logged remotely.
|
|
Log::disable_stream(Notice::LOG);
|
|
Log::disable_stream(Notice::POLICY_LOG);
|
|
Log::disable_stream(Notice::ALARM_LOG);
|
|
}
|
|
@endif
|
|
|
|
@if ( Cluster::local_node_type() == Cluster::MANAGER )
|
|
event Notice::cluster_notice(n: Notice::Info)
|
|
{
|
|
# Raise remotely received notices on the manager
|
|
NOTICE(n);
|
|
}
|
|
@endif
|