mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
1bd658da8f
This adds a "policy" hook into the logging framework's streams and
filters to replace the existing log filter predicates. The hook
signature is as follows:
hook(rec: any, id: Log::ID, filter: Log::Filter);
The logging manager invokes hooks on each log record. Hooks can veto
log records via a break, and modify them if necessary. Log filters
inherit the stream-level hook, but can override or remove the hook as
needed.
The distribution's existing log streams now come with pre-defined
hooks that users can add handlers to. Their name is standardized as
"log_policy" by convention, with additional suffixes when a module
provides multiple streams. The following adds a handler to the Conn
module's default log policy hook:
hook Conn::log_policy(rec: Conn::Info, id: Log::ID, filter: Log::Filter)
{
if ( some_veto_reason(rec) )
break;
}
By default, this handler will get invoked for any log filter
associated with the Conn::LOG stream.
The existing predicates are deprecated for removal in 4.1 but continue
to work.
85 lines
2 KiB
Text
85 lines
2 KiB
Text
@load ./main
|
|
|
|
module Broker;
|
|
|
|
export {
|
|
## The Broker logging stream identifier.
|
|
redef enum Log::ID += { LOG };
|
|
|
|
## A default logging policy hook for the stream.
|
|
global log_policy: Log::PolicyHook;
|
|
|
|
## The type of a Broker activity being logged.
|
|
type Type: enum {
|
|
## An informational status update.
|
|
STATUS,
|
|
## An error situation.
|
|
ERROR
|
|
};
|
|
|
|
## A record type containing the column fields of the Broker log.
|
|
type Info: record {
|
|
## The network time at which a Broker event occurred.
|
|
ts: time &log;
|
|
## The type of the Broker event.
|
|
ty: Type &log;
|
|
## The event being logged.
|
|
ev: string &log;
|
|
## The peer (if any) with which a Broker event is
|
|
## concerned.
|
|
peer: NetworkInfo &log &optional;
|
|
## An optional message describing the Broker event in more detail
|
|
message: string &log &optional;
|
|
};
|
|
}
|
|
|
|
event zeek_init() &priority=5
|
|
{
|
|
Log::create_stream(Broker::LOG, [$columns=Info, $path="broker", $policy=log_policy]);
|
|
}
|
|
|
|
function log_status(ev: string, endpoint: EndpointInfo, msg: string)
|
|
{
|
|
local r: Info;
|
|
|
|
r = [$ts = network_time(),
|
|
$ev = ev,
|
|
$ty = STATUS,
|
|
$message = msg];
|
|
|
|
if ( endpoint?$network )
|
|
r$peer = endpoint$network;
|
|
|
|
Log::write(Broker::LOG, r);
|
|
}
|
|
|
|
event Broker::peer_added(endpoint: EndpointInfo, msg: string)
|
|
{
|
|
log_status("peer-added", endpoint, msg);
|
|
}
|
|
|
|
event Broker::peer_removed(endpoint: EndpointInfo, msg: string)
|
|
{
|
|
log_status("peer-removed", endpoint, msg);
|
|
}
|
|
|
|
event Broker::peer_lost(endpoint: EndpointInfo, msg: string)
|
|
{
|
|
log_status("connection-terminated", endpoint, msg);
|
|
}
|
|
|
|
event Broker::error(code: ErrorCode, msg: string)
|
|
{
|
|
local ev = cat(code);
|
|
ev = subst_string(ev, "Broker::", "");
|
|
ev = subst_string(ev, "_", "-");
|
|
ev = to_lower(ev);
|
|
|
|
Log::write(Broker::LOG, [$ts = network_time(),
|
|
$ev = ev,
|
|
$ty = ERROR,
|
|
$message = msg]);
|
|
|
|
Reporter::error(fmt("Broker error (%s): %s", code, msg));
|
|
}
|
|
|