mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 03:28:19 +00:00
7b4b1779bf
This can happen if either there's no network timestamp associated with an event, or there's currently no event being dispatched. Using 0.0 isn't great as it's the normal start timestamp before reading a network packet. Using -1.0 gives the caller a chance to check and realize what's going on.
14 lines
642 B
Text
14 lines
642 B
Text
# @TEST-DOC: Check current_event_time() produces the same as event metadata, or else -1.0
|
|
#
|
|
# @TEST-EXEC: zeek -r $TRACES/http/get.trace %INPUT EventMetadata::add_network_timestamp=T >> output 2>&1
|
|
# @TEST-EXEC: zeek -r $TRACES/http/get.trace %INPUT EventMetadata::add_network_timestamp=F >> output 2>&1
|
|
#
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff output
|
|
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
print fmt("new_connection add_network_timestamp=%s current_event_time=%s network_timestamp=%s",
|
|
EventMetadata::add_network_timestamp, current_event_time(),
|
|
EventMetadata::current(EventMetadata::NETWORK_TIMESTAMP));
|
|
}
|