mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
81fe46f123
This allows to enable/disable file analyzers through the same interfaces as packet and protocol analyzers, specifically Analyzer::disable_analyzer could be interesting.
20 lines
894 B
Text
20 lines
894 B
Text
# @TEST-DOC: Add the PE analyzer to Analyzer::disabled_analyzers and ensure no pe.log is created.
|
|
|
|
# First, cross-check that pe.log is indeed generated.
|
|
# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT
|
|
# @TEST-EXEC: test -f pe.log
|
|
# @TEST-EXEC: rm *log
|
|
|
|
# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT 'Analyzer::disabled_analyzers += { Files::ANALYZER_PE }'
|
|
# @TEST-EXEC: test ! -f pe.log
|
|
# @TEST-EXEC: test -f conn.log
|
|
# @TEST-EXEC: rm *log
|
|
|
|
# Finally, explicitly enable the analyzer via Analyzer::enable_analyzer() during zeek_init() and expect pe.log to be generated.
|
|
# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT 'Analyzer::disabled_analyzers += { Files::ANALYZER_PE }' -e 'event zeek_init() { Analyzer::enable_analyzer(Files::ANALYZER_PE); }'
|
|
# @TEST-EXEC: test -f pe.log
|
|
# @TEST-EXEC: test -f conn.log
|
|
|
|
@load base/protocols/conn
|
|
@load base/protocols/ftp
|
|
@load base/files/pe
|