Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Permit weird sampling rate of 0.

Browse source 
This change allows a weird sampling rate of 0, which completely suppresses
all notifications (previously this crashed Bro). If also fixes the sampling
threshold to work with sampling rates of 0.
This commit is contained in:
Johanna Amann 2018-08-31 21:32:41 -07:00
parent e275927a64
commit 5c68093bc3
5 changed files with 57 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/Reporter.cc
View file

@ -296,11 +296,14 @@ bool Reporter::PermitNetWeird(const char* name)
timer_mgr->Add(new NetWeirdTimer(network_time, name,
weird_sampling_duration));
if ( count < weird_sampling_threshold )
if ( count <= weird_sampling_threshold )
return true;
auto num_above_threshold = count - weird_sampling_threshold;
return num_above_threshold % weird_sampling_rate == 0;
if ( weird_sampling_rate )
return num_above_threshold % weird_sampling_rate == 0;
else
return false;
}
bool Reporter::PermitFlowWeird(const char* name,
@ -316,11 +319,14 @@ bool Reporter::PermitFlowWeird(const char* name,
auto& count = map[name];
++count;
if ( count < weird_sampling_threshold )
if ( count <= weird_sampling_threshold )
return true;
auto num_above_threshold = count - weird_sampling_threshold;
return num_above_threshold % weird_sampling_rate == 0;
if ( weird_sampling_rate )
return num_above_threshold % weird_sampling_rate == 0;
else
return false;
}
void Reporter::Weird(const char* name)