63 lines
1.5 KiB
Plaintext
63 lines
1.5 KiB
Plaintext
# @TEST-DOC: suspend_processing() in zeek_init()
|
|
# @TEST-EXEC: echo "first line" > raw_file
|
|
# @TEST-EXEC: zeek -b -C -r $TRACES/wikipedia.trace %INPUT >output
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output
|
|
|
|
type OneLine: record {
|
|
s: string;
|
|
};
|
|
|
|
event one_line(desc: Input::EventDescription, e: Input::Event, s: string)
|
|
{
|
|
print network_time(), "one_line", s;
|
|
continue_processing();
|
|
}
|
|
|
|
event Input::end_of_data(name: string, source: string)
|
|
{
|
|
print network_time(), "end_of_data", name, source;
|
|
}
|
|
|
|
event zeek_init()
|
|
{
|
|
print network_time(), "zeek_init";
|
|
suspend_processing();
|
|
|
|
Input::add_event([
|
|
$name="raw-read",
|
|
# Can not use a raw command here because input reading is done
|
|
# using heartbeats and those are working based off of network
|
|
# time instead of either realtime or actually propagating back
|
|
# to the main-loop when there's data ready for reading.
|
|
#
|
|
# IMO that's a bug in how things are implemented with the
|
|
# readers being poll/heartbeat based. If polling based, seems
|
|
# wallclock time would've been the better choice.
|
|
#
|
|
# A file works, because the first DoUpdate() does the job.
|
|
#
|
|
# $source="sleep 1 |",
|
|
$source="./raw_file",
|
|
$reader=Input::READER_RAW,
|
|
$mode=Input::STREAM,
|
|
$fields=OneLine,
|
|
$ev=one_line,
|
|
$want_record=F,
|
|
]);
|
|
}
|
|
|
|
event network_time_init()
|
|
{
|
|
print network_time(), "network_time_init";
|
|
}
|
|
|
|
event Pcap::file_done(path: string)
|
|
{
|
|
print network_time(), "Pcap::file_done", path;
|
|
}
|
|
|
|
event zeek_done()
|
|
{
|
|
print network_time(), "zeek_done";
|
|
}
|