Still outstanding, scheduled events when Bro terminates

Zeek
1

Hi

I write regularly (5min interval) some information to a file
which I use externally in a webpage by parsing the content.
I want to overwrite the old file everytime and don't like to
use log rotation because of disk space consumption.

I use the following code:

******** log.bro **********
# writes a summary of the currently seen hosts
# and its states to the file "current_states.log"
# do this regularly all Xmins (log_interval)
event print_current_states_file() {
         # opens the file "current_states.log"
         local current_states_file = open("current_states.log");

         # write file header
         print "...";
  ...

         # close the file "current_states.log"
         close(current_states_file);

         # do it again in Xmins
         schedule log_interval {print_current_states_file()};
}

event bro_init() {
         # start log
         schedule log_interval {print_current_states_file()};
}

2

The function bro_is_terminating returns true if Bro is cleaning up.
You could call that in print_current_states_file to avoid writing
the file.

Robin

3

Hi Robin

When I terminate Bro it writes the scheduled print_current_states_file
event a last time. Unfortunately, the data that i write to the file is
already incomplete because Bro already started to delete these tables.

The function bro_is_terminating returns true if Bro is cleaning up.
You could call that in print_current_states_file to avoid writing
the file.

Very nice. Thank you. Works perfect.

Cheers
Christoph