zeek icon indicating copy to clipboard operation
zeek copied to clipboard

Warn on Log::create_stream() without $policy

Open awelzel opened this issue 1 year ago • 0 comments

As an implementation idea unless someone has strong feelings this could be annoying:

Outside of testing, a Log::create_stream() should almost always have a log policy hook set via the $policy field to enable easy filtering/extension of the logs by implementing a hook handler.

Currently, a new analyzer or package providing a log stream may start out without a log policy. But almost always after broader deployment, real-world scenarios and downstream customization/filtering or inclusion in products, in practice, the $policy field of a log stream approaches that of a "required field".

The idea would be to log a warning upon a Log::create_stream() without a $policy so that analyzer and Zeek package authors are nudged to include it from the get go.

awelzel avatar Apr 26 '23 14:04 awelzel