mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
b6e6302b40
The changes are now a bit more succinct with less code changes required. Behavior is tested a little bit more thoroughly and a memory problem when reading incomplete lines was fixed. ReadHeader also always directly returns if header reading failed. Error messages now are back to what they were before the change, if the new behavior is not used. I also tweaked the documentation text a bit.
66 lines
1.5 KiB
Text
66 lines
1.5 KiB
Text
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
|
# @TEST-EXEC: btest-bg-wait 10
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
|
# @TEST-EXEC: sed 1d .stderr > .stderrwithoutfirstline
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderrwithoutfirstline
|
|
|
|
@TEST-START-FILE input.log
|
|
#separator \x09
|
|
#fields i c
|
|
#types int count
|
|
l
|
|
5
|
|
@TEST-END-FILE
|
|
|
|
redef exit_only_after_terminate = T;
|
|
redef InputAscii::fail_on_invalid_lines = T;
|
|
|
|
global outfile: file;
|
|
|
|
module A;
|
|
|
|
type Idx: record {
|
|
i: string;
|
|
};
|
|
|
|
type Val: record {
|
|
c: count;
|
|
};
|
|
|
|
global endcount: count = 0;
|
|
|
|
global servers: table[string] of Val = table();
|
|
|
|
event handle_our_errors(desc: Input::TableDescription, msg: string, level: Reporter::Level)
|
|
{
|
|
print outfile, "TableErrorEvent", msg, level;
|
|
}
|
|
|
|
event handle_our_errors_event(desc: Input::EventDescription, msg: string, level: Reporter::Level)
|
|
{
|
|
print outfile, "EventErrorEvent", msg, level;
|
|
}
|
|
|
|
event line(description: Input::EventDescription, tpe: Input::Event, v: Val)
|
|
{
|
|
print outfile, "Event", v;
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
outfile = open("../out");
|
|
# first read in the old stuff into the table...
|
|
Input::add_table([$source="../input.log", $name="ssh", $error_ev=handle_our_errors, $idx=Idx, $val=Val, $destination=servers]);
|
|
Input::add_event([$source="../input.log", $name="sshevent", $error_ev=handle_our_errors_event, $fields=Val, $want_record=T, $ev=line]);
|
|
}
|
|
|
|
event Input::end_of_data(name: string, source:string)
|
|
{
|
|
++endcount;
|
|
|
|
if ( endcount == 2 )
|
|
{
|
|
print outfile, servers;
|
|
terminate();
|
|
}
|
|
}
|