mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
60 lines
2.4 KiB
Text
60 lines
2.4 KiB
Text
##! Interface for the DataSeries log writer.
|
|
|
|
module LogDataSeries;
|
|
|
|
export {
|
|
## Compression to use with the DS output file. Options are:
|
|
##
|
|
## 'none' -- No compression.
|
|
## 'lzf' -- LZF compression. Very quick, but leads to larger output files.
|
|
## 'lzo' -- LZO compression. Very fast decompression times.
|
|
## 'gz' -- GZIP compression. Slower than LZF, but also produces smaller output.
|
|
## 'bz2' -- BZIP2 compression. Slower than GZIP, but also produces smaller output.
|
|
const compression = "gz" &redef;
|
|
|
|
## The extent buffer size.
|
|
## Larger values here lead to better compression and more efficient writes, but
|
|
## also increase the lag between the time events are received and the time they
|
|
## are actually written to disk.
|
|
const extent_size = 65536 &redef;
|
|
|
|
## Should we dump the XML schema we use for this DS file to disk?
|
|
## If yes, the XML schema shares the name of the logfile, but has
|
|
## an XML ending.
|
|
const dump_schema = F &redef;
|
|
|
|
## How many threads should DataSeries spawn to perform compression?
|
|
## Note that this dictates the number of threads per log stream. If
|
|
## you're using a lot of streams, you may want to keep this number
|
|
## relatively small.
|
|
##
|
|
## Default value is 1, which will spawn one thread / stream.
|
|
##
|
|
## Maximum is 128, minimum is 1.
|
|
const num_threads = 1 &redef;
|
|
|
|
## Should time be stored as an integer or a double?
|
|
## Storing time as a double leads to possible precision issues and
|
|
## can (significantly) increase the size of the resulting DS log.
|
|
## That said, timestamps stored in double form are consistent
|
|
## with the rest of Bro, including the standard ASCII log. Hence, we
|
|
## use them by default.
|
|
const use_integer_for_time = F &redef;
|
|
}
|
|
|
|
# Default function to postprocess a rotated DataSeries log file. It moves the
|
|
# rotated file to a new name that includes a timestamp with the opening time, and
|
|
# then runs the writer's default postprocessor command on it.
|
|
function default_rotation_postprocessor_func(info: Log::RotationInfo) : bool
|
|
{
|
|
# Move file to name including both opening and closing time.
|
|
local dst = fmt("%s.%s.ds", info$path,
|
|
strftime(Log::default_rotation_date_format, info$open));
|
|
|
|
system(fmt("/bin/mv %s %s", info$fname, dst));
|
|
|
|
# Run default postprocessor.
|
|
return Log::run_rotation_postprocessor_cmd(info, dst);
|
|
}
|
|
|
|
redef Log::default_rotation_postprocessors += { [Log::WRITER_DATASERIES] = default_rotation_postprocessor_func };
|