mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
513ea7e04f
With the introduction of LogAscii::logdir, log filenames can now include parent directories rather than being plain basenames. Enabling log rotation, leftover log rotation and setting LogAscii::logdir broke due to not handling this situation. This change ensures that .shadow files are placed within the directory where the respective .log file is created. Previously, the .shadow. (or .tmp.shadow.) prefix was simply prepended, yielding non-sensical paths such as .tmp.shadow.foo/bar/packet_filter.log for a logdir of foo/bar. Additionally, respect LogAscii::logdir when searching for leftover log files rather than defaulting to the current working directory. The following quirk exist around LogAscii::logdir, but will be addressed in a follow-up. * By default, logs are currently rotated into the working directory of the process, rather than staying confined within LogAscii::logdir. One of the added tests shows this behavior.
34 lines
1.2 KiB
Text
34 lines
1.2 KiB
Text
# @TEST-DOC: Test that .shadow files are picked up from LogAscii::logdir.
|
|
# @TEST-EXEC: mkdir logs
|
|
# @TEST-EXEC: echo ".log" >> logs/.shadow.conn.log
|
|
# @TEST-EXEC: echo "my_rotation_postprocessor" >> logs/.shadow.conn.log
|
|
# @TEST-EXEC: echo "leftover conn log" > logs/conn.log
|
|
# @TEST-EXEC: echo ".log" >> logs/.shadow.dns.log
|
|
# @TEST-EXEC: echo "my_rotation_postprocessor" >> logs/.shadow.dns.log
|
|
# @TEST-EXEC: echo "leftover dns log" > logs/dns.log
|
|
|
|
# @TEST-EXEC: zeek -b %INPUT > out
|
|
|
|
# @TEST-EXEC: ! test -f logs/.shadow.conn.log
|
|
# @TEST-EXEC: ! test -f logs/conn.log
|
|
# @TEST-EXEC: ! test -f logs/.shadow.dns.log
|
|
# @TEST-EXEC: ! test -f logs/dns.log
|
|
|
|
# Ensure rotated logs ends-up in the current working directory: This may change in the future.
|
|
# @TEST-EXEC: cat ./conn-*.log ./dns-*.log > logs.cat
|
|
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
|
# @TEST-EXEC: btest-diff logs.cat
|
|
|
|
module GLOBAL;
|
|
|
|
function my_rotation_postprocessor(info: Log::RotationInfo) : bool
|
|
{
|
|
print fmt("running my rotation postprocessor for path '%s'", info$path);
|
|
return T;
|
|
}
|
|
|
|
redef LogAscii::logdir = "./logs";
|
|
redef LogAscii::enable_leftover_log_rotation = T;
|
|
redef Log::default_rotation_interval = 1hr;
|
|
redef Log::default_rotation_postprocessor_cmd = "echo";
|