Add EventHandler version of stats plugin

This commit is contained in:
Tim Wojtulewicz 2022-11-10 11:20:07 -07:00
parent 194960eafa
commit 3a963f080e
3 changed files with 30 additions and 0 deletions

View file

@ -52,6 +52,8 @@ void EventHandler::SetFunc(FuncPtr f)
void EventHandler::Call(Args* vl, bool no_remote) void EventHandler::Call(Args* vl, bool no_remote)
{ {
call_count++;
if ( new_event ) if ( new_event )
NewEvent(vl); NewEvent(vl);

View file

@ -52,6 +52,8 @@ public:
void SetGenerateAlways() { generate_always = true; } void SetGenerateAlways() { generate_always = true; }
bool GenerateAlways() const { return generate_always; } bool GenerateAlways() const { return generate_always; }
uint64_t CallCount() const { return call_count; }
private: private:
void NewEvent(zeek::Args* vl); // Raise new_event() meta event. void NewEvent(zeek::Args* vl); // Raise new_event() meta event.
@ -62,6 +64,7 @@ private:
bool enabled; bool enabled;
bool error_handler; // this handler reports error messages. bool error_handler; // this handler reports error messages.
bool generate_always; bool generate_always;
uint64_t call_count = 0;
std::unordered_set<std::string> auto_publish; std::unordered_set<std::string> auto_publish;
}; };

View file

@ -484,3 +484,28 @@ function get_reporter_stats%(%): ReporterStats
return r; return r;
%} %}
function get_event_handler_call_counts%(%): EventNameStats
%{
auto rval = zeek::make_intrusive<zeek::VectorVal>(zeek::id::find_type<VectorType>("EventNameStats"));
const auto& recordType = zeek::id::find_type<RecordType>("EventNameCounter");
int i = 0;
const auto& events = event_registry->UsedHandlers();
for ( const auto& name : events )
{
auto handler = event_registry->Lookup(name);
auto call_count = handler->CallCount();
if ( call_count > 0 )
{
auto eventStatRecord = zeek::make_intrusive<zeek::RecordVal>(recordType);
eventStatRecord->Assign(0, zeek::make_intrusive<zeek::StringVal>(name));
eventStatRecord->Assign(1, zeek::val_mgr->Count(handler->CallCount()));
rval->Assign(i, std::move(eventStatRecord));
i++;
}
}
return rval;
%}