base/frameworks/input/readers/raw.zeek

InputRaw

Interface for the raw input reader.

Namespace

InputRaw

Summary

Redefinable Options

InputRaw::record_separator: string &redef

Separator between input records.

Events

InputRaw::process_finished: event

Event that is called when a process created by the raw reader exits.

Detailed Interface

Redefinable Options

InputRaw::record_separator
Type

string

Attributes

&redef

Default

"\x0a"

Separator between input records. Please note that the separator has to be exactly one character long.

Events

InputRaw::process_finished
Type

event (name: string, source: string, exit_code: count, signal_exit: bool)

Event that is called when a process created by the raw reader exits.

Parameters

  • name – name of the input stream.

  • source – source of the input stream.

  • exit_code – exit code of the program, or number of the signal that forced the program to exit.

  • signal_exit – false when program exited normally, true when program was forced to exit by a signal.