diff --git a/src/EventHandler.cc b/src/EventHandler.cc index 09ba72c27d..62a616a619 100644 --- a/src/EventHandler.cc +++ b/src/EventHandler.cc @@ -52,6 +52,8 @@ void EventHandler::SetFunc(FuncPtr f) void EventHandler::Call(Args* vl, bool no_remote) { + call_count++; + if ( new_event ) NewEvent(vl); diff --git a/src/EventHandler.h b/src/EventHandler.h index b2137be402..c8947f1082 100644 --- a/src/EventHandler.h +++ b/src/EventHandler.h @@ -52,6 +52,8 @@ public: void SetGenerateAlways() { generate_always = true; } bool GenerateAlways() const { return generate_always; } + uint64_t CallCount() const { return call_count; } + private: void NewEvent(zeek::Args* vl); // Raise new_event() meta event. @@ -62,6 +64,7 @@ private: bool enabled; bool error_handler; // this handler reports error messages. bool generate_always; + uint64_t call_count = 0; std::unordered_set auto_publish; }; diff --git a/src/stats.bif b/src/stats.bif index ba5b94efae..d7131da482 100644 --- a/src/stats.bif +++ b/src/stats.bif @@ -484,3 +484,28 @@ function get_reporter_stats%(%): ReporterStats return r; %} + +function get_event_handler_call_counts%(%): EventNameStats + %{ + auto rval = zeek::make_intrusive(zeek::id::find_type("EventNameStats")); + const auto& recordType = zeek::id::find_type("EventNameCounter"); + + int i = 0; + const auto& events = event_registry->UsedHandlers(); + for ( const auto& name : events ) + { + auto handler = event_registry->Lookup(name); + auto call_count = handler->CallCount(); + + if ( call_count > 0 ) + { + auto eventStatRecord = zeek::make_intrusive(recordType); + eventStatRecord->Assign(0, zeek::make_intrusive(name)); + eventStatRecord->Assign(1, zeek::val_mgr->Count(handler->CallCount())); + rval->Assign(i, std::move(eventStatRecord)); + i++; + } + } + + return rval; + %}