Cleaned up stats collection.

- Removed the gap_report event.  It wasn't used anymore
   and functionally no more capable that scheduling events
   and using the get_gap_summary bif.

 - Added functionality to Dictionaries to count cumulative
   numbers of inserts performed.  This is further used to
   measure the total number of connections of various types.
   Previously only the number of active connections was
   available.

 - The Reassembler base class now tracks active reassembly
   size for all subclasses (File/TCP/Frag & unknown).

 - Improvements to the stats.log.  Mostly, more information.
This commit is contained in:
Seth Hall 2016-01-04 00:55:52 -05:00
parent 374e61ee20
commit 2b0a28686a
14 changed files with 189 additions and 117 deletions

View file

@ -1,6 +1,7 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include <algorithm>
#include <vector>
#include "bro-config.h"
@ -10,7 +11,8 @@
static const bool DEBUG_reassem = false;
DataBlock::DataBlock(const u_char* data, uint64 size, uint64 arg_seq,
DataBlock* arg_prev, DataBlock* arg_next)
DataBlock* arg_prev, DataBlock* arg_next,
ReassemblerType reassem_type)
{
seq = arg_seq;
upper = seq + size;
@ -26,17 +28,24 @@ DataBlock::DataBlock(const u_char* data, uint64 size, uint64 arg_seq,
if ( next )
next->prev = this;
if ( Reassembler::sizes.size() == 0 )
Reassembler::sizes.resize(REASSEM_TERM, 0);
rtype = reassem_type;
Reassembler::sizes[rtype] += pad_size(size) + padded_sizeof(DataBlock);
Reassembler::total_size += pad_size(size) + padded_sizeof(DataBlock);
}
uint64 Reassembler::total_size = 0;
std::vector<uint64> Reassembler::sizes;
Reassembler::Reassembler(uint64 init_seq)
Reassembler::Reassembler(uint64 init_seq, ReassemblerType reassem_type)
{
blocks = last_block = 0;
old_blocks = last_old_block = 0;
total_old_blocks = max_old_blocks = 0;
trim_seq = last_reassem_seq = init_seq;
rtype = reassem_type;
}
Reassembler::~Reassembler()
@ -110,7 +119,7 @@ void Reassembler::NewBlock(double t, uint64 seq, uint64 len, const u_char* data)
if ( ! blocks )
blocks = last_block = start_block =
new DataBlock(data, len, seq, 0, 0);
new DataBlock(data, len, seq, 0, 0, rtype);
else
start_block = AddAndCheck(blocks, seq, upper_seq, data);
@ -275,7 +284,7 @@ DataBlock* Reassembler::AddAndCheck(DataBlock* b, uint64 seq, uint64 upper,
if ( last_block && seq == last_block->upper )
{
last_block = new DataBlock(data, upper - seq, seq,
last_block, 0);
last_block, 0, rtype);
return last_block;
}
@ -288,7 +297,7 @@ DataBlock* Reassembler::AddAndCheck(DataBlock* b, uint64 seq, uint64 upper,
{
// b is the last block, and it comes completely before
// the new block.
last_block = new DataBlock(data, upper - seq, seq, b, 0);
last_block = new DataBlock(data, upper - seq, seq, b, 0, rtype);
return last_block;
}
@ -297,7 +306,7 @@ DataBlock* Reassembler::AddAndCheck(DataBlock* b, uint64 seq, uint64 upper,
if ( upper <= b->seq )
{
// The new block comes completely before b.
new_b = new DataBlock(data, upper - seq, seq, b->prev, b);
new_b = new DataBlock(data, upper - seq, seq, b->prev, b, rtype);
if ( b == blocks )
blocks = new_b;
return new_b;
@ -308,7 +317,7 @@ DataBlock* Reassembler::AddAndCheck(DataBlock* b, uint64 seq, uint64 upper,
{
// The new block has a prefix that comes before b.
uint64 prefix_len = b->seq - seq;
new_b = new DataBlock(data, prefix_len, seq, b->prev, b);
new_b = new DataBlock(data, prefix_len, seq, b->prev, b, rtype);
if ( b == blocks )
blocks = new_b;
@ -342,6 +351,17 @@ DataBlock* Reassembler::AddAndCheck(DataBlock* b, uint64 seq, uint64 upper,
return new_b;
}
uint64 Reassembler::MemoryAllocation(ReassemblerType rtype)
{
if (Reassembler::sizes.size() == 0 )
Reassembler::sizes.resize(REASSEM_TERM, 0);
if ( rtype < REASSEM_TERM )
return Reassembler::sizes[rtype];
else
return 0;
}
bool Reassembler::Serialize(SerialInfo* info) const
{
return SerialObj::Serialize(info);