Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

GH-780: Prevent log batches from indefinite buffering

Browse source 
Logs that got sent sparsely or burstily would get buffered for long
periods of time since the logic to flush them only does so on the next
log write.  In the worst case, a subsequent log write could never happen
and cause a log entry to be indefinitely buffered.

This fix introduces a recurring event/timer to simply flush all pending
logs at frequency of Broker::log_batch_interval.
This commit is contained in:
Jon Siwek 2020-02-05 13:03:21 -08:00
parent 0de6bba95e
commit 43e54c7930
17 changed files with 224 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/Baseline/scripts.policy.misc.dump-events/all-events-no-args.log
View file

@ -1,6 +1,7 @@
0.000000 zeek_init
0.000000 filter_change_tracking
0.000000 NetControl::init
1254722767.492060 Broker::log_flush
1254722767.492060 ChecksumOffloading::check
1254722767.492060 filter_change_tracking
1254722767.492060 new_connection
@ -19,6 +20,7 @@
1254722768.219663 smtp_reply
1254722768.224809 protocol_confirmation
1254722768.224809 smtp_request
1254722768.565386 Broker::log_flush
1254722768.566183 smtp_reply
1254722768.566183 smtp_reply
1254722768.566183 smtp_reply
@ -30,6 +32,7 @@
1254722768.911655 smtp_request
1254722769.253544 smtp_reply
1254722769.254118 smtp_request
1254722769.613798 Broker::log_flush
1254722769.613798 smtp_reply
1254722769.614414 smtp_request
1254722769.956765 smtp_reply
@ -37,6 +40,7 @@
1254722770.319708 smtp_reply
1254722770.320203 smtp_request
1254722770.320203 mime_begin_entity
1254722770.661679 Broker::log_flush
1254722770.661679 smtp_reply
1254722770.692743 mime_one_header
1254722770.692743 mime_one_header
@ -86,6 +90,7 @@
1254722770.692804 file_over_new_connection
1254722770.695115 new_connection
1254722771.494181 file_sniff
1254722771.834595 Broker::log_flush
1254722771.858334 mime_end_entity
1254722771.858334 get_file_handle
1254722771.858334 file_state_remove
@ -97,12 +102,15 @@
1254722771.858334 get_file_handle
1254722771.858334 smtp_request
1254722772.248789 smtp_reply
1254722774.763825 Broker::log_flush
1254722774.763825 smtp_request
1254722775.105467 smtp_reply
1254722776.690444 Broker::log_flush
1254722776.690444 new_connection
1437831776.764391 ChecksumOffloading::check
1437831776.764391 connection_state_remove
1437831776.764391 successful_connection_remove
1437831776.764391 Broker::log_flush
1437831776.764391 connection_state_remove
1437831776.764391 successful_connection_remove
1437831776.764391 connection_state_remove
@ -111,6 +119,7 @@
1437831776.764391 successful_connection_remove
1437831776.764391 filter_change_tracking
1437831776.764391 new_connection
1437831787.856895 Broker::log_flush
1437831787.856895 new_connection
1437831787.861602 connection_established
1437831787.867142 smtp_reply
@ -155,9 +164,11 @@
1437831787.905375 get_file_handle
1437831787.905375 smtp_request
1437831787.914113 smtp_reply
1437831798.533593 Broker::log_flush
1437831798.533593 new_connection
1437831799.262632 new_connection
1437831799.461152 new_connection
1437831799.610433 Broker::log_flush
1437831799.610433 connection_established
1437831799.611764 ssl_extension_server_name
1437831799.611764 ssl_extension
@ -216,6 +227,7 @@
1437831800.045701 ssl_plaintext_data
1437831800.045701 ssl_established
1437831800.217854 net_done
1437831800.217854 Broker::log_flush
1437831800.217854 filter_change_tracking
1437831800.217854 connection_state_remove
1437831800.217854 successful_connection_remove

12
testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
View file

File diff suppressed because one or more lines are too long