base/frameworks/control/main.zeek

Control

The control framework provides the foundation for providing “commands” that can be taken remotely at runtime to modify a running Zeek instance or collect information from the running instance.

Namespace

Control

Summary

Redefinable Options

Control::arg: string &redef

This can be used by commands that take an argument.

Control::cmd: string &redef

The command that is being done.

Control::commands: set &redef

The commands that can currently be given on the command line for remote control.

Control::controllee_listen: bool &redef

Whether the controllee should call Broker::listen.

Control::host: addr &redef

The address of the host that will be controlled.

Control::host_port: port &redef

The port of the host that will be controlled.

Control::zone_id: string &redef

If Control::host is a non-global IPv6 address and requires a specific RFC 4007 zone_id, it can be set here.

Constants

Control::ignore_ids: set

Variable IDs that are to be ignored by the update process.

Control::topic_prefix: string

The topic prefix used for exchanging control messages via Broker.

Events

Control::configuration_update: event

This event is a wrapper and alias for the Control::configuration_update_request event.

Control::configuration_update_request: event

Inform the remote Zeek instance that it’s configuration may have been updated.

Control::configuration_update_response: event

Message in response to a configuration update request.

Control::id_value_request: event

Event for requesting the value of an ID (a variable).

Control::id_value_response: event

Event for returning the value of an ID after an Control::id_value_request event.

Control::net_stats_request: event

Requests the current net_stats.

Control::net_stats_response: event

Returns the current net_stats.

Control::peer_status_request: event

Requests the current communication status.

Control::peer_status_response: event

Returns the current communication status.

Control::shutdown_request: event

Requests that the Zeek instance begins shutting down.

Control::shutdown_response: event

Message in response to a shutdown request.

Detailed Interface

Redefinable Options

Control::arg
Type

string

Attributes

&redef

Default

""

This can be used by commands that take an argument.

Control::cmd
Type

string

Attributes

&redef

Default

""

The command that is being done. It’s typically set on the command line.

Control::commands
Type

set [string]

Attributes

&redef

Default
{
   "peer_status",
   "id_value",
   "net_stats",
   "configuration_update",
   "shutdown"
}

The commands that can currently be given on the command line for remote control.

Control::controllee_listen
Type

bool

Attributes

&redef

Default

T

Whether the controllee should call Broker::listen. In a cluster, this isn’t needed since the setup process calls it.

Control::host
Type

addr

Attributes

&redef

Default

0.0.0.0

The address of the host that will be controlled.

Control::host_port
Type

port

Attributes

&redef

Default

0/tcp

The port of the host that will be controlled.

Control::zone_id
Type

string

Attributes

&redef

Default

""

If Control::host is a non-global IPv6 address and requires a specific RFC 4007 zone_id, it can be set here.

Constants

Control::ignore_ids
Type

set [string]

Default

{}

Variable IDs that are to be ignored by the update process.

Control::topic_prefix
Type

string

Default

"zeek/control"

The topic prefix used for exchanging control messages via Broker.

Events

Control::configuration_update
Type

event ()

This event is a wrapper and alias for the Control::configuration_update_request event. This event is also a primary hooking point for the control framework.

Control::configuration_update_request
Type

event ()

Inform the remote Zeek instance that it’s configuration may have been updated.

Control::configuration_update_response
Type

event ()

Message in response to a configuration update request.

Control::id_value_request
Type

event (id: string)

Event for requesting the value of an ID (a variable).

Control::id_value_response
Type

event (id: string, val: string)

Event for returning the value of an ID after an Control::id_value_request event.

Control::net_stats_request
Type

event ()

Requests the current net_stats.

Control::net_stats_response
Type

event (s: string)

Returns the current net_stats.

Control::peer_status_request
Type

event ()

Requests the current communication status.

Control::peer_status_response
Type

event (s: string)

Returns the current communication status.

Control::shutdown_request
Type

event ()

Requests that the Zeek instance begins shutting down.

Control::shutdown_response
Type

event ()

Message in response to a shutdown request.