work in progress on idaholab#570

cisagov · Oct 16, 2024 · dc28103 · dc28103
1 parent 9779364
commit dc28103
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/hedgehog-iso/config/includes.chroot/usr/local/etc/zeek/local.zeek b/hedgehog-iso/config/includes.chroot/usr/local/etc/zeek/local.zeek
@@ -47,6 +47,11 @@ global disable_ics_synchrophasor = (getenv("ZEEK_DISABLE_ICS_SYNCHROPHASOR") ==
 redef Broker::default_listen_address = "127.0.0.1";
 redef ignore_checksums = T;
 
+global zeek_capture_interface = getenv("ZEEK_CAPTURE_INTERFACE");
+@if (zeek_capture_interface != "")
+  redef Log::default_logdir = zeek_capture_interface;
+@endif
+
 global capture_filter_str = getenv("CAPTURE_FILTER");
 @if (capture_filter_str != "")
   redef restrict_filters += { ["user-defined capture filter"] = capture_filter_str };

diff --git a/shared/bin/zeekdeploy.sh b/shared/bin/zeekdeploy.sh
@@ -301,7 +301,7 @@ for IFACE in ${CAPTURE_INTERFACE//,/ }; do
 type=worker
 host=localhost
 interface=$IFACE
-env_vars=ZEEK_EXTRACTOR_MODE=$ZEEK_EXTRACTOR_MODE,ZEEK_EXTRACTOR_PATH=$EXTRACT_FILES_PATH/,TMP=$TMP_PATH
+env_vars=ZEEK_CAPTURE_INTERFACE=$IFACE,ZEEK_EXTRACTOR_MODE=$ZEEK_EXTRACTOR_MODE,ZEEK_EXTRACTOR_PATH=$EXTRACT_FILES_PATH/,TMP=$TMP_PATH
 EOF
   # if af_packet is available in the kernel, write it out as well
   if [ $AF_PACKET_SUPPORT -gt 0 ] && [ $WORKER_LB_PROCS -gt 0 ]; then