mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
53b0f0ad64
This deprecates the Event constructor and the ``ts`` parameter of Enqueue() Instead, versions are introduced that take a detail::MetadataVectorPtr which can hold the network timestamp metadata and is meant to be allocated by the caller instead of automatically during Enqueue() or within the Event constructor. This also introduces a BifConst ``EventMetadata::add_network_timestamp`` to opt-in adding network timestamps to events globally. It's disabled by default as there are not a lot of known use cases that need this.
22 lines
531 B
Text
22 lines
531 B
Text
# @TEST-EXEC: zeek -b -r $TRACES/ticks-dns-1hr.pcap %INPUT > out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
redef EventMetadata::add_network_timestamp = T;
|
|
|
|
global runs = 0;
|
|
|
|
event test(schedule_time: time)
|
|
{
|
|
print fmt("[%D] Test was scheduled at %D for %D", network_time(),
|
|
schedule_time, current_event_time());
|
|
}
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
local nt = network_time();
|
|
print fmt(">> Run %s (%D)", runs, nt);
|
|
schedule 30 mins { test(nt) };
|
|
schedule 15 mins { test(nt) };
|
|
print fmt("<< Run %s (%D)", runs, nt);
|
|
++runs;
|
|
}
|