mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
597a4d6704
- policy/ renamed to scripts/ - By default BROPATH now contains: - scripts/ - scripts/policy - scripts/site - *Nearly* all tests pass. - All of scripts/base/ is loaded by main.cc - Can be disabled by setting $BRO_NO_BASE_SCRIPTS - Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script). - The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building. - The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead. - All "detection" activity happens through scripts in scripts/policy/. - Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1) - This is so the communications framework can be loaded as part of the base without causing trouble when it's not needed. - This will be removed once a resolution to ticket #540 is reached.
68 lines
No EOL
1.9 KiB
Text
68 lines
No EOL
1.9 KiB
Text
|
|
module Cluster;
|
|
|
|
export {
|
|
redef enum Log::ID += { CLUSTER };
|
|
type Info: record {
|
|
ts: time;
|
|
message: string;
|
|
} &log;
|
|
|
|
type NodeType: enum {
|
|
CONTROL,
|
|
MANAGER,
|
|
PROXY,
|
|
WORKER,
|
|
TIME_MACHINE,
|
|
};
|
|
|
|
## Events raised by the manager and handled by the workers.
|
|
const manager_events = /Drop::.*/ &redef;
|
|
|
|
## Events raised by the proxies and handled by the manager.
|
|
const proxy_events = /Notice::notice/ &redef;
|
|
|
|
## Events raised by workers and handled by the manager.
|
|
const worker_events = /(Notice::notice|TimeMachine::command|Drop::.*)/ &redef;
|
|
|
|
## Events sent by the control host (i.e. BroControl) when dynamically
|
|
## connecting to a running instance to update settings or request data.
|
|
const control_events = Control::controller_events &redef;
|
|
|
|
## Record type to indicate a node in a cluster.
|
|
type Node: record {
|
|
node_type: NodeType;
|
|
ip: addr;
|
|
p: port;
|
|
|
|
## Identifier for the interface a worker is sniffing.
|
|
interface: string &optional;
|
|
|
|
## Manager node this node uses. For workers and proxies.
|
|
manager: string &optional;
|
|
## Proxy node this node uses. For workers and managers.
|
|
proxy: string &optional;
|
|
## Worker nodes that this node connects with. For managers and proxies.
|
|
workers: set[string] &optional;
|
|
time_machine: string &optional;
|
|
};
|
|
|
|
const nodes: table[string] of Node = {} &redef;
|
|
|
|
## This is usually supplied on the command line for each instance
|
|
## of the cluster that is started up.
|
|
const node = getenv("CLUSTER_NODE") &redef;
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
# If a node is given, but it's an unknown name we need to fail.
|
|
if ( node != "" && node !in nodes )
|
|
{
|
|
local msg = "You didn't supply a valid node in the Cluster::nodes configuration.";
|
|
event reporter_error(current_time(), msg, "");
|
|
terminate();
|
|
}
|
|
|
|
Log::create_stream(CLUSTER, [$columns=Info]);
|
|
} |