diff --git a/CHANGES b/CHANGES index e9b39f7a..d93f874f 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,22 @@ +2.0.1 | 2022-02-21 15:26:44 +0100 + + * Add a test build of the source code tarball to CI. + + * Extend query API to allow specifying tables that must/must not be + present. Agents will ignore queries not meeting expectations. + + * Extract version information from Zeek's hello message. + + * Adapt to changes to options in the Zeek package. + + * Fix differential queries returning empty removed rows. + + * Fix time filtering for differential queries. + + * Fix double table deactivation. + + * Guard against an error case in Darwin system logs collector. + 2.0.0 | 2022-02-14 16:14:48 +0100 * Initial release. diff --git a/VERSION b/VERSION index 227cea21..38f77a65 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.0.0 +2.0.1 diff --git a/src/io/zeek.cc b/src/io/zeek.cc index 399fd824..24156b0d 100644 --- a/src/io/zeek.cc +++ b/src/io/zeek.cc @@ -431,7 +431,6 @@ void BrokerConnection::processEvent(const broker::data_message& msg) { if ( query_record[4] != broker::data() ) cookie = broker::get(query_record[4]); - zquery = ZeekQuery{.zeek_instance = std::move(zeek_instance_id), std::set requires_tables; for ( const auto& t : broker::get(query_record[5]) ) requires_tables.emplace(broker::get(t)); @@ -440,7 +439,7 @@ void BrokerConnection::processEvent(const broker::data_message& msg) { for ( const auto& t : broker::get(query_record[6]) ) if_missing_tables.emplace(broker::get(t)); - zquery = ZeekQuery{.zeek_instance = std::move(zeek_instance), + zquery = ZeekQuery{.zeek_instance = std::move(zeek_instance_id), .zeek_id = zeek_id, .event_name = std::move(event_name), .zeek_cookie = cookie, diff --git a/tests/zeek/if-missing-table.zeek b/tests/zeek/if-missing-table.zeek index c7b984dc..9954644a 100644 --- a/tests/zeek/if-missing-table.zeek +++ b/tests/zeek/if-missing-table.zeek @@ -9,7 +9,7 @@ # @TEST-EXEC: btest-diff zeek/.stdout @if ( getenv("ZEEK_PORT") != "" ) -redef Broker::default_port = to_port(getenv("ZEEK_PORT")); +redef ZeekAgent::listen_port = to_port(getenv("ZEEK_PORT")); @endif type Columns: record { diff --git a/tests/zeek/requires-table.zeek b/tests/zeek/requires-table.zeek index 9a2300ba..f61b03ea 100644 --- a/tests/zeek/requires-table.zeek +++ b/tests/zeek/requires-table.zeek @@ -9,7 +9,7 @@ # @TEST-EXEC: btest-diff zeek/.stdout @if ( getenv("ZEEK_PORT") != "" ) -redef Broker::default_port = to_port(getenv("ZEEK_PORT")); +redef ZeekAgent::listen_port = to_port(getenv("ZEEK_PORT")); @endif event do_terminate() {