logging.zeek

Analyzer::Logging

Logging analyzer violations into analyzer.log

Namespace:: Analyzer::Logging
Imports:: base/frameworks/analyzer/main.zeek, base/frameworks/logging

Summary

Runtime Options

Analyzer::Logging::failure_data_max_size: count &redef

If a violation contains information about the data causing it, include at most this many bytes of it in the log.

Types

Analyzer::Logging::Info: record

The record type defining the columns to log in the analyzer logging stream.

Redefinitions

Log::ID: enum

Add the analyzer logging stream identifier.

Analyzer::Logging::LOG

Events

Analyzer::Logging::log_analyzer: event

An event that can be handled to access the Analyzer::Logging::Info record as it is sent on to the logging framework.

Hooks

Analyzer::Logging::log_policy: Log::PolicyHook

A default logging policy hook for the stream.

Detailed Interface

Runtime Options

Analyzer::Logging::failure_data_max_size 

Type:: count
Attributes:: &redef
Default:: 40

If a violation contains information about the data causing it, include at most this many bytes of it in the log.

Types

Analyzer::Logging::Info 

Type:

record

Fields:

ts: time &log: Timestamp of the violation.

analyzer_kind: string &log: The kind of analyzer involved. Currently “packet”, “file” or “protocol”.

analyzer_name: string &log: The name of the analyzer as produced by Analyzer::name for the analyzer’s tag.

uid: string &log &optional: Connection UID if available.

fuid: string &log &optional: File UID if available.

id: conn_id &log &optional: Connection identifier if available.

proto: transport_proto &log &optional: Transport protocol for the violation, if available.

failure_reason: string &log: Failure or violation reason, if available.

failure_data: string &log &optional: Data causing failure or violation if available. Truncated to Analyzer::Logging::failure_data_max_size.

packet_segment: string &optional &log

(present if policy/frameworks/analyzer/packet-segment-logging.zeek is loaded)

A chunk of the payload that most likely resulted in the analyzer violation.

The record type defining the columns to log in the analyzer logging stream.

Events

Analyzer::Logging::log_analyzer 

Type:: event (rec: Analyzer::Logging::Info)

An event that can be handled to access the Analyzer::Logging::Info record as it is sent on to the logging framework.

Hooks

Analyzer::Logging::log_policy 

Type:: Log::PolicyHook

A default logging policy hook for the stream.