Skip to content
This repository was archived by the owner on Oct 13, 2025. It is now read-only.

Commit 6190118

Browse files
committed
devel: Add event metadata plugin example
1 parent ca6fc42 commit 6190118

File tree

13 files changed

+467
-0
lines changed

13 files changed

+467
-0
lines changed

devel/plugins.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -490,3 +490,4 @@ Plugin Tutorials
490490
:maxdepth: 1
491491

492492
plugins/connkey-plugin
493+
plugins/event-metadata-plugin
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
build
2+
*.log
3+
.state
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
2+
3+
project(ZeekPluginEventLatency)
4+
5+
include(ZeekPlugin)
6+
7+
zeek_add_plugin(
8+
Zeek
9+
EventLatency
10+
SOURCES
11+
src/Plugin.cc
12+
SCRIPT_FILES scripts/__load__.zeek
13+
)
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
Copyright (c) 2025 by the Zeek Project. All rights reserved.
2+
3+
Redistribution and use in source and binary forms, with or without modification,
4+
are permitted provided that the following conditions are met:
5+
6+
1. Redistributions of source code must retain the above copyright notice, this
7+
list of conditions and the following disclaimer.
8+
9+
2. Redistributions in binary form must reproduce the above copyright notice,
10+
this list of conditions and the following disclaimer in the documentation
11+
and/or other materials provided with the distribution.
12+
13+
3. Neither the name of the copyright holder nor the names of its contributors
14+
may be used to endorse or promote products derived from this software
15+
without specific prior written permission.
16+
17+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
18+
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
21+
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22+
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23+
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
24+
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
26+
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#
2+
# Convenience Makefile providing a few common top-level targets.
3+
#
4+
5+
cmake_build_dir=build
6+
arch=`uname -s | tr A-Z a-z`-`uname -m`
7+
8+
all: build-it
9+
10+
build-it:
11+
( cd $(cmake_build_dir) && make )
12+
13+
install:
14+
( cd $(cmake_build_dir) && make install )
15+
16+
clean:
17+
( cd $(cmake_build_dir) && make clean )
18+
19+
distclean:
20+
rm -rf $(cmake_build_dir)
21+
22+
test:
23+
make -C tests

devel/plugins/event-metadata-plugin-src/README

Whitespace-only changes.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0.1.0
Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
#!/bin/sh
2+
#
3+
# Wrapper for viewing/setting options that the plugin's CMake
4+
# scripts will recognize.
5+
#
6+
# Don't edit this. Edit configure.plugin to add plugin-specific options.
7+
#
8+
9+
set -e
10+
command="$0 $*"
11+
12+
if [ -e $(dirname $0)/configure.plugin ]; then
13+
# Include custom additions.
14+
. $(dirname $0)/configure.plugin
15+
fi
16+
17+
usage() {
18+
19+
cat 1>&2 <<EOF
20+
Usage: $0 [OPTIONS]
21+
22+
Plugin Options:
23+
--cmake=PATH Path to CMake binary
24+
--zeek-dist=DIR Path to Zeek source tree
25+
--install-root=DIR Path where to install plugin into
26+
--with-binpac=DIR Path to BinPAC installation root
27+
--with-broker=DIR Path to Broker installation root
28+
--with-bifcl=PATH Path to bifcl executable
29+
--enable-debug Compile in debugging mode
30+
--disable-cpp-tests Don't build C++ unit tests
31+
EOF
32+
33+
if type plugin_usage >/dev/null 2>&1; then
34+
plugin_usage 1>&2
35+
fi
36+
37+
echo
38+
39+
exit 1
40+
}
41+
42+
# Function to append a CMake cache entry definition to the
43+
# CMakeCacheEntries variable
44+
# $1 is the cache entry variable name
45+
# $2 is the cache entry variable type
46+
# $3 is the cache entry variable value
47+
append_cache_entry() {
48+
CMakeCacheEntries="$CMakeCacheEntries -D $1:$2=$3"
49+
}
50+
51+
# set defaults
52+
builddir=build
53+
zeekdist=""
54+
installroot="default"
55+
zeek_plugin_begin_opts=""
56+
CMakeCacheEntries=""
57+
58+
while [ $# -ne 0 ]; do
59+
case "$1" in
60+
-*=*) optarg=$(echo "$1" | sed 's/[-_a-zA-Z0-9]*=//') ;;
61+
*) optarg= ;;
62+
esac
63+
64+
case "$1" in
65+
--help | -h)
66+
usage
67+
;;
68+
69+
--cmake=*)
70+
CMakeCommand=$optarg
71+
;;
72+
73+
--zeek-dist=*)
74+
zeekdist=$(cd $optarg && pwd)
75+
;;
76+
77+
--install-root=*)
78+
installroot=$optarg
79+
;;
80+
81+
--with-binpac=*)
82+
append_cache_entry BinPAC_ROOT_DIR PATH $optarg
83+
binpac_root=$optarg
84+
;;
85+
86+
--with-broker=*)
87+
append_cache_entry BROKER_ROOT_DIR PATH $optarg
88+
broker_root=$optarg
89+
;;
90+
91+
--with-bifcl=*)
92+
append_cache_entry BifCl_EXE PATH $optarg
93+
;;
94+
95+
--enable-debug)
96+
append_cache_entry BRO_PLUGIN_ENABLE_DEBUG BOOL true
97+
;;
98+
99+
--disable-cpp-tests)
100+
zeek_plugin_begin_opts="DISABLE_CPP_TESTS;$zeek_plugin_begin_opts"
101+
;;
102+
103+
*)
104+
if type plugin_option >/dev/null 2>&1; then
105+
plugin_option $1 && shift && continue
106+
fi
107+
108+
echo "Invalid option '$1'. Try $0 --help to see available options."
109+
exit 1
110+
;;
111+
esac
112+
shift
113+
done
114+
115+
if [ -z "$CMakeCommand" ]; then
116+
# prefer cmake3 over "regular" cmake (cmake == cmake2 on RHEL)
117+
if command -v cmake3 >/dev/null 2>&1; then
118+
CMakeCommand="cmake3"
119+
elif command -v cmake >/dev/null 2>&1; then
120+
CMakeCommand="cmake"
121+
else
122+
echo "This plugin requires CMake, please install it first."
123+
echo "Then you may use this script to configure the CMake build."
124+
echo "Note: pass --cmake=PATH to use cmake in non-standard locations."
125+
exit 1
126+
fi
127+
fi
128+
129+
if [ -z "$zeekdist" ]; then
130+
if type zeek-config >/dev/null 2>&1; then
131+
zeek_config="zeek-config"
132+
else
133+
echo "Either 'zeek-config' must be in PATH or '--zeek-dist=<path>' used"
134+
exit 1
135+
fi
136+
137+
append_cache_entry BRO_CONFIG_PREFIX PATH $(${zeek_config} --prefix)
138+
append_cache_entry BRO_CONFIG_INCLUDE_DIR PATH $(${zeek_config} --include_dir)
139+
append_cache_entry BRO_CONFIG_PLUGIN_DIR PATH $(${zeek_config} --plugin_dir)
140+
append_cache_entry BRO_CONFIG_LIB_DIR PATH $(${zeek_config} --lib_dir)
141+
append_cache_entry BRO_CONFIG_CMAKE_DIR PATH $(${zeek_config} --cmake_dir)
142+
append_cache_entry CMAKE_MODULE_PATH PATH $(${zeek_config} --cmake_dir)
143+
144+
build_type=$(${zeek_config} --build_type)
145+
146+
if [ "$build_type" = "debug" ]; then
147+
append_cache_entry BRO_PLUGIN_ENABLE_DEBUG BOOL true
148+
fi
149+
150+
if [ -z "$binpac_root" ]; then
151+
append_cache_entry BinPAC_ROOT_DIR PATH $(${zeek_config} --binpac_root)
152+
fi
153+
154+
if [ -z "$broker_root" ]; then
155+
append_cache_entry BROKER_ROOT_DIR PATH $(${zeek_config} --broker_root)
156+
fi
157+
else
158+
if [ ! -e "$zeekdist/zeek-path-dev.in" ]; then
159+
echo "$zeekdist does not appear to be a valid Zeek source tree."
160+
exit 1
161+
fi
162+
163+
# BRO_DIST is the canonical/historical name used by plugin CMake scripts
164+
# ZEEK_DIST doesn't serve a function at the moment, but set/provided anyway
165+
append_cache_entry BRO_DIST PATH $zeekdist
166+
append_cache_entry ZEEK_DIST PATH $zeekdist
167+
append_cache_entry CMAKE_MODULE_PATH PATH $zeekdist/cmake
168+
fi
169+
170+
if [ "$installroot" != "default" ]; then
171+
mkdir -p $installroot
172+
append_cache_entry BRO_PLUGIN_INSTALL_ROOT PATH $installroot
173+
fi
174+
175+
if [ -n "$zeek_plugin_begin_opts" ]; then
176+
append_cache_entry ZEEK_PLUGIN_BEGIN_OPTS STRING "$zeek_plugin_begin_opts"
177+
fi
178+
179+
if type plugin_addl >/dev/null 2>&1; then
180+
plugin_addl
181+
fi
182+
183+
echo "Build Directory : $builddir"
184+
echo "Zeek Source Directory : $zeekdist"
185+
186+
mkdir -p $builddir
187+
cd $builddir
188+
189+
"$CMakeCommand" $CMakeCacheEntries ..
190+
191+
echo "# This is the command used to configure this build" >config.status
192+
echo $command >>config.status
193+
chmod u+x config.status
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
module EventLatency;
2+
3+
redef enum EventMetadata::ID += {
4+
## The absolute timestamp at which this event was published.
5+
WALLCLOCK_TIMESTAMP = 10001000,
6+
};
7+
8+
event zeek_init()
9+
{
10+
assert EventMetadata::register(WALLCLOCK_TIMESTAMP, time);
11+
}
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Empty

0 commit comments

Comments
 (0)