zeek/scripts/base
Arne Welzel c813872915 cluster/supervisor: Multi-logger awareness
When multiple loggers are configured in a Supervisor controlled cluster
configuration, encode extra information into the rotated filename to
identify which logger produced the log.

This is similar to the approach taken for ZeekControl, re-using the
log_suffix terminology, but as there's only a single zeek-archiver
process and no postprocessors and no other side-channel for additional
information, we encode extra metadata into the filename. zeek-archiver
is extended to recognize the special metadata part of the filename.

This also solves the issue that multiple loggers in a supervisor setup
overwrite each others log files within a single log-queue directory.
2023-05-05 12:27:25 +02:00
..
files Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
frameworks cluster/supervisor: Multi-logger awareness 2023-05-05 12:27:25 +02:00
misc annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
packet-protocols Add forwarding from VLAN analyzer into LLC, SNAP, and Novell 802.3 analyzers 2023-04-25 12:29:55 -07:00
protocols Merge remote-tracking branch 'origin/topic/awelzel/smb2-state-handling' 2023-05-04 09:40:19 +02:00
utils Treat private address space as site-local by default 2023-03-15 17:01:00 -07:00
init-bare.zeek smb2: Limit per-connection read/ioctl/tree state 2023-05-03 10:58:59 +02:00
init-default.zeek Provide infrastructure to migrate legacy analyzers to Spicy. 2023-02-01 11:33:48 +01:00
init-frameworks-and-bifs.zeek analyzer: Add analyzer.log for logging violations/confirmations 2023-01-09 18:11:49 +01:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00