adding fields to HTTP log - cluster environment

Zeek
1

Hi everyone,

I am trying to add a new field to HTTP log.

I want to check if orig_h is in a table, if true then add the value from that table to the record.

I have a script that works in a single bro instance, but does not work in a cluster environment:

@load base/protocol/http

redef record HTTP::Info += {

field: string &log &optional;

}

event http_message_done(c: connection, is_orig: bool, stat: http_message_stat)
{

if ( c$http$id$orig_h in test_table )
{

c$http$field = test_table[c$http$id$orig_h];

}

}

I am not sure why this script works with bro in a single instance mode but not in cluster mode.

Also, giving a higher priority to http_message_done event will override the actual event in main.bro under http ?

thanks

B

2

Do you have “test_table” set as “&synchronized”?

3

Hi,

my mistake, another script ran and removed the default fields on HTTP :slight_smile:

Thanks anyways

B