types.zeek¶

ClusterController::Types¶

This module holds the basic types needed for the Cluster Controller framework. These are used by both agent and controller, and several have corresponding equals in the zeek-client implementation.

Namespace: ClusterController::Types

Summary¶

Types¶

`ClusterController::Types::Configuration`: `record`	Data structure capturing a cluster’s complete configuration.
`ClusterController::Types::Instance`: `record`	Configuration describing a Zeek instance running a Cluster Agent.
`ClusterController::Types::InstanceVec`: `vector`
`ClusterController::Types::Node`: `record`	Configuration describing a Cluster Node process.
`ClusterController::Types::Option`: `record`	A Zeek-side option with value.
`ClusterController::Types::Result`: `record`	Return value for request-response API event pairs
`ClusterController::Types::ResultVec`: `vector`
`ClusterController::Types::Role`: `enum`	Management infrastructure node type.
`ClusterController::Types::State`: `enum`	State that a Cluster Node can be in.

Functions¶

ClusterController::Types::result_to_string: function

Detailed Interface¶

Types¶

ClusterController::Types::Configuration ¶

Type

record

id: string &default = fD0qxAnfwOe &optional: Unique identifier for a particular configuration
instances: set [ClusterController::Types::Instance] &default = { } &optional: The instances in the cluster.
nodes: set [ClusterController::Types::Node] &default = { } &optional: The set of nodes in the cluster, as distributed over the instances.

Data structure capturing a cluster’s complete configuration.

ClusterController::Types::Instance ¶

Type

record

name: string: Unique, human-readable instance name
host: addr: IP address of system
listen_port: port &optional: Agent listening port. Not needed if agents connect to controller.

Configuration describing a Zeek instance running a Cluster Agent. Normally, there’ll be one instance per cluster system: a single physical system.

ClusterController::Types::InstanceVec ¶

Type: vector of ClusterController::Types::Instance

ClusterController::Types::Node ¶

Type

record

name: string: Cluster-unique, human-readable node name
instance: string: Name of instance where node is to run
p: port: Port on which this node will listen
role: Supervisor::ClusterRole: Role of the node.
state: ClusterController::Types::State: Desired, or current, run state.
scripts: vector of string &optional: Additional Zeek scripts for node
options: set [ClusterController::Types::Option] &optional: Zeek options for node
interface: string &optional: Interface to sniff
cpu_affinity: int &optional: CPU/core number to pin to
env: table [string] of string &default = { } &optional: Custom environment vars

Configuration describing a Cluster Node process.

ClusterController::Types::Option ¶

Type

record

name: string: Name of option
value: string: Value of option

A Zeek-side option with value.

ClusterController::Types::Result ¶

Type

record

reqid: string: Request ID of operation this result refers to
instance: string &default = "" &optional: Name of associated instance (for context)
success: bool &default = T &optional: True if successful
data: any &optional: Addl data returned for successful operation
error: string &default = "" &optional: Descriptive error on failure
node: string &optional: Name of associated node (for context)

Return value for request-response API event pairs

ClusterController::Types::ResultVec ¶

Type: vector of ClusterController::Types::Result

ClusterController::Types::Role ¶

Type

enum

ClusterController::Types::NONE¶

ClusterController::Types::AGENT¶

ClusterController::Types::CONTROLLER¶

Management infrastructure node type. This intentionally does not include the data cluster node types (worker, logger, etc) – those continue to be managed by the cluster framework.

ClusterController::Types::State ¶

Type

enum

ClusterController::Types::Running¶: Running and operating normally

ClusterController::Types::Stopped¶: Explicitly stopped

ClusterController::Types::Failed¶: Failed to start; and permanently halted

ClusterController::Types::Crashed¶: Crashed, will be restarted,

ClusterController::Types::Unknown¶: State not known currently (e.g., because of lost connectivity)

State that a Cluster Node can be in. State changes trigger an API notification (see notify_change()).

Functions¶

ClusterController::Types::result_to_string ¶

Type: function (res: ClusterController::Types::Result) : string