mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
513ea7e04f
With the introduction of LogAscii::logdir, log filenames can now include parent directories rather than being plain basenames. Enabling log rotation, leftover log rotation and setting LogAscii::logdir broke due to not handling this situation. This change ensures that .shadow files are placed within the directory where the respective .log file is created. Previously, the .shadow. (or .tmp.shadow.) prefix was simply prepended, yielding non-sensical paths such as .tmp.shadow.foo/bar/packet_filter.log for a logdir of foo/bar. Additionally, respect LogAscii::logdir when searching for leftover log files rather than defaulting to the current working directory. The following quirk exist around LogAscii::logdir, but will be addressed in a follow-up. * By default, logs are currently rotated into the working directory of the process, rather than staying confined within LogAscii::logdir. One of the added tests shows this behavior.
35 lines
1 KiB
Text
35 lines
1 KiB
Text
# @TEST-DOC: Enable leftover log rotation and logdir. Note, files are rotated into the cwd.
|
|
# @TEST-EXEC: mkdir logs
|
|
# @TEST-EXEC: zeek -b -r ${TRACES}/rotation.trace %INPUT >zeek.out 2>&1
|
|
# @TEST-EXEC: grep "test" zeek.out | sort >out
|
|
# @TEST-EXEC: for i in `ls test.*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
module Test;
|
|
|
|
export {
|
|
# Create a new ID for our log stream
|
|
redef enum Log::ID += { LOG };
|
|
|
|
# Define a record with all the columns the log file can have.
|
|
# (I'm using a subset of fields from ssh-ext for demonstration.)
|
|
type Log: record {
|
|
t: time;
|
|
id: conn_id; # Will be rolled out into individual columns.
|
|
} &log;
|
|
}
|
|
|
|
redef LogAscii::logdir = "./logs";
|
|
redef LogAscii::enable_leftover_log_rotation = T;
|
|
redef Log::default_rotation_interval = 1hr;
|
|
redef Log::default_rotation_postprocessor_cmd = "echo";
|
|
|
|
event zeek_init()
|
|
{
|
|
Log::create_stream(Test::LOG, [$columns=Log]);
|
|
}
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
Log::write(Test::LOG, [$t=network_time(), $id=c$id]);
|
|
}
|