main.zeek

Implements base functionality for MySQL analysis. Generates the mysql.log file.

Namespace: MySQL
Imports: base/protocols/conn/removal-hooks.zeek, base/protocols/mysql/consts.zeek

Summary

`Log::ID`: `enum`	`mysql::LOG`
`connection`: `record`	New Fields `connection` mysql: `MySQL::Info` `&optional`

Event that can be handled to access the MySQL record as it is sent on to the logging framework.

`MySQL::finalize_mysql`: `Conn::RemovalHook`	MySQL finalization hook.
`MySQL::log_policy`: `Log::PolicyHook`

Type

record

ts: time &log: Timestamp for when the event happened.
uid: string &log: Unique ID for the connection.
id: conn_id &log: The connection’s 4-tuple of endpoint addresses/ports.
cmd: string &log: The command that was issued
arg: string &log: The argument issued to the command
success: bool &log &optional: Did the server tell us that the command succeeded?
rows: count &log &optional: The number of affected rows, if any
response: string &log &optional: Server message, if any

Event that can be handled to access the MySQL record as it is sent on to the logging framework.

MySQL finalization hook. Remaining MySQL info may get logged when it’s called.