zeek
zeek copied to clipboard
Warn on Log::create_stream() without $policy
As an implementation idea unless someone has strong feelings this could be annoying:
Outside of testing, a Log::create_stream()
should almost always have a log policy hook set via the $policy
field to enable easy filtering/extension of the logs by implementing a hook handler.
Currently, a new analyzer or package providing a log stream may start out without a log policy. But almost always after broader deployment, real-world scenarios and downstream customization/filtering or inclusion in products, in practice, the $policy
field of a log stream approaches that of a "required field".
The idea would be to log a warning upon a Log::create_stream()
without a $policy
so that analyzer and Zeek package authors are nudged to include it from the get go.