Zeek (Bro) rename log according to input file - analysis

I'm running zeek/bro on individual pcap files with the command line parameter -r inputfile.pcap. How can I access the file name of this input file in a bro script? I would like to rename the conn.log to inputfile_conn.log.

As far as I can tell, that's not possible. For one thing, it appears that you can give multiple pcap files to zeek on the command line, and they are all opened in parallel. In that case, there would be no correct answer to "what pcap is being processed?" In any case, I can't find any way that would be exposed to scripts.
I would recommend you work around it by wrapping zeek with a script that places the name of the file into an environment variable. Then within the script, you can use getenv to obtain the value stored in the environment variable.

Related

Avoid reading the same file multiple times using Telegraf and file input plugin

I need to read csv files inside a folder. New csv files are generated every time a user submits a form. I'm using the "file" input plugin to read the data and send it to Influxdb. These steps are working fine.
The problem is that the same file is read multiple times every data collection interval. I was thinking of a solution where I could move the file that was read to a different folder, but I couldn't do that with Telegraf's "exec" output plug.
ps: I can't change the way csv files are generated.
Any ideas on how to avoid reading the same csv file multiple times?
As you discovered file input plugin is used to read entire files at each collection interval.
My suggestion is for you to instead use the directory monitor input plugin. This will read files in a directory, monitor the directory for new files, and parse the ones that have not already been picked up yet. There are some configuration settings in that plugin that make it easier to time when new files are read as well.
Another option is to use the tail input plugin which will tail a file and only read new updates to that file as things come. However, I think the directory monitor is more likely something you are after for your scenario.
Thanks!

How to make local environment same for Do File Editor as for Command/Results (to use tempfiles)

How can I make the environment be the same for the Do File editor and the Command/Results?
What I mean is this: if one runs code from the Do File editor that defines a local (local localname localvalue), then that local is not accessible when typing in the Command window. How can I make the environment (meaning the environment as it refers to locals) the same for both the Do File editor and the Command window?
The practical reason I want to do this is that I use lots of tempfiles in my code. If I have hundreds or thousands of lines of code written up in the Do File editor, I need to copy and paste all of them into the Command window in order to access the individual tempfiles when testing out individual lines of code in the Command window. This is a bit tedious to have to do over and over.
As an example, suppose that we run this code from the Do File editor:
sysuse auto2, clear
tempfile auto
save `auto'
Then we cannot access auto from the Command window. Is it possible to change a setting in Stata that will in fact allow us to access auto?

I need to open some files in a folder that contains "RPA" in their name. so how can I do that in automation anywhere?

I am creating a program that opens files in a folder that contains "RPA" in their name. so, how can I do that?
You will use Loop on File in Folder command, and if condition inside the loop to check if the file name includes RPA.
Loop on Files on Folder
If condition $Filename$ includes RPA
Do Something here eg. open program/file command
End If
End Loop
#Shivam,
To get more clarity on your problem statement, you mentioned once that the files are already in PDF.
Are you trying to copy content from PDF to Word? In that case, you could use PDF Integration commands, provided the PDFs are not hand-written or scans. If that is the case, the text extraction might become more unreliable.
A safe bet with Automation Anywhere is to just extract all the text, open a new Word document and paste the content and save file.
Saving all files as word might a little counter-intuitive. You can just use the If statement within your for loop to only process files with "RPA" in their name.
Hope this help. Let us know you go :-)
its pretty simple use includes in your if statement
workbench snapshot

Is Modifying the content of a file possible in mqfte using ant task?

I have to substitute the letter "A" with letter "C" in the content of a txt file.
Let test.txt be a txt file. The content is as follows:
Ace Apple
I need the content in the destination folder to be as :
Cce Cpple.
Is this possible in mqfte using ant tasks?
The short answer is "yes."
The longer answer is that you can do anything with Ant that can be scripted, including calling other scripts. The approach would be to use a post-destination call that would edit the file after it arrives. This call won't fire if the file transfer fails. If the transfer succeeds the post-destination call does fire and will run your task or script to edit the file. Just remember that if you configure this to run as a monitor, it will fire on every file transfer. If you want to run it as an ad-hoc transfer you will need to submit it from the command line since the GUI does not support the pre/post calls.

How do I find out the path of the file triggered by opening a file with a custom file extension?

How do i get the location of the file that i used to open my programs with?
Example: if i create a new extention ".xyz" say and i tell windows that i want to open the file type .xyz with myapplication, then it starts my aplication. Great, but how does my application get a handle on the file path of the file that was used to start it?
Also, is there a way to keep just one version of my app running and new files that are opened to just call a method in my application? For example if your using a torrent and you open 5 .torrent files they all just get passed to one application.
Side question: are all file extensions 3 letters long and is there a list of ones that are publicly used? If im creating a file extension I don't want to use one that is already used.
When you created your file association, you specified the command line that Explorer should run to activate your program. The shell puts the name of the document file on the command line, too, so in your program, check the command-line arguments. How you do that depends on your language and development environment. In Delphi, use the ParamCount and ParamStr functions.
When you create the file association, you can specify exactly where on the command line the document file name should go. Use %1 somewhere on the command line, and the shell will replace it with the file name. Since Windows file names frequently contains spaces, you should put quotation marks around the file name, so the command line in the file association would look like this:
ArthurApp.exe "%1"
With that association, double-clicking another document file will start another instance of your program. If you'd prefer to have the document opened in another window of the already-running instance, then you can write code to make your program look for already-running instances when it starts up. If it finds one, then it can communicate with that instance to tell it what file to open. You can effect that communication any number of ways, including mailslots, sockets, named pipes, memory-mapped files, and DDE.
The shell's file-association mechanism already has a way of communicating via DDE, so a second instance of your program wouldn't be started at all. Instead, the shell would start a DDE conversation with the already-running instance and tell it the new file name that way. However, DDE seems to be falling out of favor nowadays, so check out some of the other options first.
For your side question, no, extensions are not always three characters long. Look around, and that should be obvious: C code goes in .c files, Adobe Illustrator graphics go in .ai files, and new Microsoft Word documents go in .docx files.
But beware. If you ask for **.doc*, the results will include .docx files as well. That's because FindFirstFile matches both short and long file names, and long file names with long file extensions have three-character extensions in their short-file-name versions.
Rob covered the answer to your question(s) beautifully.
As to the last part, whether there is a public list of file extensions - not as such, but there is shell.windows.com, the web service Explorer uses to locate handlers for unknown file extensions. You can make up an extension then query shell.windows.com to see whether it's been registered. For example, to check whether the extension .blah has been registered by anyone on shell.windows.com, just open this URL in any browser:
http://shell.windows.com/fileassoc/0409/xml/redir.asp?ext=blah
Of course, replace the trailing blah with your extension.
You can find more details about this in KB929149 and in Raymond Chen's post Where does shell.windows.com get information about file extensions, and how do I get in on that action?.

Resources