github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-16 14:58:31 +00:00
Code Issues Projects Releases Wiki Activity

Implicit time in output formats

Browse Source 
As pointed out by Loris, timestamping output messages should be a
responsibility of the output/collection system.

So as a first step towards this, add timestamps automatically for output
formats, and remove them from rules.
This commit is contained in:
Henri DF
2016-03-29 19:47:57 -07:00
parent bc7f955127
commit 97d7b125ba
2 changed files with 37 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
userspace/digwatch/lua/rule_loader.lua
View File

@@ -5,7 +5,7 @@
--]]
local DEFAULT_OUTPUT_FORMAT = "%evt.num %evt.time %evt.cpu %proc.name (%thread.tid) %evt.dir %evt.type %evt.args"
local DEFAULT_OUTPUT_FORMAT = "%evt.time: %evt.num %evt.cpu %proc.name (%thread.tid) %evt.dir %evt.type %evt.args"
local compiler = require "compiler"
@@ -113,7 +113,7 @@ function set_output(output_ast)
format = output_ast.value
end
state.outputs[state.n_rules] = {type="format", formatter=digwatch.formatter(format)}
state.outputs[state.n_rules] = {type="format", formatter=digwatch.formatter("%evt.time: "..format)}
elseif (output_ast.type == "FunctionCall") then
require(output_ast.mname)