mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
513ea7e04f
With the introduction of LogAscii::logdir, log filenames can now include parent directories rather than being plain basenames. Enabling log rotation, leftover log rotation and setting LogAscii::logdir broke due to not handling this situation. This change ensures that .shadow files are placed within the directory where the respective .log file is created. Previously, the .shadow. (or .tmp.shadow.) prefix was simply prepended, yielding non-sensical paths such as .tmp.shadow.foo/bar/packet_filter.log for a logdir of foo/bar. Additionally, respect LogAscii::logdir when searching for leftover log files rather than defaulting to the current working directory. The following quirk exist around LogAscii::logdir, but will be addressed in a follow-up. * By default, logs are currently rotated into the working directory of the process, rather than staying confined within LogAscii::logdir. One of the added tests shows this behavior.
131 lines
4.1 KiB
Text
131 lines
4.1 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
test.2011-03-07-03-00-05.log test 11-03-07_03.00.05 11-03-07_04.00.05 0 ascii
|
|
test.2011-03-07-04-00-05.log test 11-03-07_04.00.05 11-03-07_05.00.05 0 ascii
|
|
test.2011-03-07-05-00-05.log test 11-03-07_05.00.05 11-03-07_06.00.05 0 ascii
|
|
test.2011-03-07-06-00-05.log test 11-03-07_06.00.05 11-03-07_07.00.05 0 ascii
|
|
test.2011-03-07-07-00-05.log test 11-03-07_07.00.05 11-03-07_08.00.05 0 ascii
|
|
test.2011-03-07-08-00-05.log test 11-03-07_08.00.05 11-03-07_09.00.05 0 ascii
|
|
test.2011-03-07-09-00-05.log test 11-03-07_09.00.05 11-03-07_10.00.05 0 ascii
|
|
test.2011-03-07-10-00-05.log test 11-03-07_10.00.05 11-03-07_11.00.05 0 ascii
|
|
test.2011-03-07-11-00-05.log test 11-03-07_11.00.05 11-03-07_12.00.05 0 ascii
|
|
test.2011-03-07-12-00-05.log test 11-03-07_12.00.05 11-03-07_12.59.55 1 ascii
|
|
> test.2011-03-07-03-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1024
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 0
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-04-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1025
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 1
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-05-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1026
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 2
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-06-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1027
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 3
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-07-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1028
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 4
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-08-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1029
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 5
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-09-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1030
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 6
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-10-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1031
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 7
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-11-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1032
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 8
|
|
#close XXXX-XX-XX-XX-XX-XX
|
|
> test.2011-03-07-12-00-05.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path test
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields t id.orig_h id.orig_p id.resp_h id.resp_p
|
|
#types time addr port addr port
|
|
XXXXXXXXXX.XXXXXX 10.0.0.1 20 10.0.0.2 1033
|
|
XXXXXXXXXX.XXXXXX 10.0.0.2 20 10.0.0.3 9
|
|
#close XXXX-XX-XX-XX-XX-XX
|