mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Remove statistics plugin in favor of stats bif
This commit is contained in:
parent
3a963f080e
commit
5d5f5de1d1
11 changed files with 7 additions and 137 deletions
|
@ -794,7 +794,7 @@ type ReporterStats: record {
|
||||||
|
|
||||||
## Statistics about how many times each event name is queued.
|
## Statistics about how many times each event name is queued.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: Statistics::get_and_reset_event_name_statistics
|
## .. zeek:see:: get_event_handler_call_counts
|
||||||
type EventNameCounter: record {
|
type EventNameCounter: record {
|
||||||
## Name of the zeek event.
|
## Name of the zeek event.
|
||||||
name: string &log;
|
name: string &log;
|
||||||
|
|
|
@ -197,7 +197,6 @@ add_subdirectory(file_analysis)
|
||||||
add_subdirectory(input)
|
add_subdirectory(input)
|
||||||
add_subdirectory(iosource)
|
add_subdirectory(iosource)
|
||||||
add_subdirectory(logging)
|
add_subdirectory(logging)
|
||||||
add_subdirectory(statistics)
|
|
||||||
add_subdirectory(probabilistic)
|
add_subdirectory(probabilistic)
|
||||||
add_subdirectory(session)
|
add_subdirectory(session)
|
||||||
|
|
||||||
|
@ -545,7 +544,7 @@ if (ZEEK_STANDALONE)
|
||||||
${bro_PLUGIN_LIBS}
|
${bro_PLUGIN_LIBS}
|
||||||
)
|
)
|
||||||
target_link_libraries(zeek ${bro_PLUGIN_LINK_LIBS} ${zeekdeps} ${CMAKE_THREAD_LIBS_INIT} ${CMAKE_DL_LIBS})
|
target_link_libraries(zeek ${bro_PLUGIN_LINK_LIBS} ${zeekdeps} ${CMAKE_THREAD_LIBS_INIT} ${CMAKE_DL_LIBS})
|
||||||
|
|
||||||
# Export symbols from zeek executable for use by plugins
|
# Export symbols from zeek executable for use by plugins
|
||||||
set_target_properties(zeek PROPERTIES ENABLE_EXPORTS TRUE)
|
set_target_properties(zeek PROPERTIES ENABLE_EXPORTS TRUE)
|
||||||
|
|
||||||
|
|
|
@ -1,9 +0,0 @@
|
||||||
|
|
||||||
include(ZeekPlugin)
|
|
||||||
|
|
||||||
include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
|
|
||||||
|
|
||||||
zeek_plugin_begin(Zeek Statistics)
|
|
||||||
zeek_plugin_cc(Plugin.cc)
|
|
||||||
bif_target(statistics.bif)
|
|
||||||
zeek_plugin_end()
|
|
|
@ -1,57 +0,0 @@
|
||||||
|
|
||||||
#include "Plugin.h"
|
|
||||||
|
|
||||||
#include <mutex>
|
|
||||||
|
|
||||||
#include "zeek/Conn.h"
|
|
||||||
#include "zeek/Desc.h"
|
|
||||||
#include "zeek/Event.h"
|
|
||||||
#include "zeek/Func.h"
|
|
||||||
#include "zeek/RunState.h"
|
|
||||||
#include "zeek/threading/Formatter.h"
|
|
||||||
|
|
||||||
#include "statistics.bif.h"
|
|
||||||
|
|
||||||
namespace zeek::plugin::statistics
|
|
||||||
{
|
|
||||||
Plugin plugin;
|
|
||||||
}
|
|
||||||
|
|
||||||
using namespace zeek::plugin::statistics;
|
|
||||||
|
|
||||||
zeek::plugin::Configuration Plugin::Configure()
|
|
||||||
{
|
|
||||||
zeek::plugin::Configuration config;
|
|
||||||
config.name = "Statistics";
|
|
||||||
config.description = "Statistics module";
|
|
||||||
config.version.major = 1;
|
|
||||||
config.version.minor = 0;
|
|
||||||
config.version.patch = 0;
|
|
||||||
return config;
|
|
||||||
}
|
|
||||||
|
|
||||||
bool Plugin::HookQueueEvent(zeek::Event* event)
|
|
||||||
{
|
|
||||||
const char* name = event->Handler()->Name();
|
|
||||||
|
|
||||||
std::lock_guard<std::mutex> scopedLock(m_lock);
|
|
||||||
if ( m_eventNameCounters.find(name) == m_eventNameCounters.end() )
|
|
||||||
{
|
|
||||||
m_eventNameCounters[name] = 0;
|
|
||||||
}
|
|
||||||
m_eventNameCounters[name]++;
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
std::unordered_map<const char*, int> Plugin::GetAndResetEventStatistics()
|
|
||||||
{
|
|
||||||
std::lock_guard<std::mutex> scopedLock(m_lock);
|
|
||||||
std::unordered_map<const char*, int> result(m_eventNameCounters);
|
|
||||||
m_eventNameCounters.clear();
|
|
||||||
return result;
|
|
||||||
}
|
|
||||||
|
|
||||||
void Plugin::StartEventNamesStatisticsMonitor()
|
|
||||||
{
|
|
||||||
EnableHook(zeek::plugin::HOOK_QUEUE_EVENT);
|
|
||||||
}
|
|
|
@ -1,30 +0,0 @@
|
||||||
|
|
||||||
#pragma once
|
|
||||||
|
|
||||||
#include <mutex>
|
|
||||||
#include <string>
|
|
||||||
#include <unordered_map>
|
|
||||||
|
|
||||||
#include "zeek/plugin/Plugin.h"
|
|
||||||
|
|
||||||
namespace zeek::plugin::statistics
|
|
||||||
{
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin
|
|
||||||
{
|
|
||||||
protected:
|
|
||||||
bool HookQueueEvent(zeek::Event* event) override;
|
|
||||||
|
|
||||||
zeek::plugin::Configuration Configure() override;
|
|
||||||
|
|
||||||
public:
|
|
||||||
std::unordered_map<const char*, int> GetAndResetEventStatistics();
|
|
||||||
void StartEventNamesStatisticsMonitor();
|
|
||||||
|
|
||||||
private:
|
|
||||||
std::unordered_map<const char*, int> m_eventNameCounters;
|
|
||||||
std::mutex m_lock;
|
|
||||||
};
|
|
||||||
|
|
||||||
extern Plugin plugin;
|
|
||||||
}
|
|
|
@ -1,29 +0,0 @@
|
||||||
|
|
||||||
%%{
|
|
||||||
#include "zeek/statistics/Plugin.h"
|
|
||||||
%%}
|
|
||||||
|
|
||||||
function Statistics::get_and_reset_event_name_statistics%(%): EventNameStats
|
|
||||||
%{
|
|
||||||
auto rval = zeek::make_intrusive<zeek::VectorVal>(zeek::id::find_type<VectorType>("EventNameStats"));
|
|
||||||
auto stats = zeek::plugin::statistics::plugin.GetAndResetEventStatistics();
|
|
||||||
const auto& recordType = zeek::id::find_type<RecordType>("EventNameCounter");
|
|
||||||
|
|
||||||
auto i = 0;
|
|
||||||
for (auto& eventCounter : stats)
|
|
||||||
{
|
|
||||||
auto eventStatRecord = zeek::make_intrusive<zeek::RecordVal>(recordType);
|
|
||||||
eventStatRecord->Assign(0, zeek::make_intrusive<zeek::StringVal>(eventCounter.first));
|
|
||||||
eventStatRecord->Assign(1, zeek::val_mgr->Count(eventCounter.second));
|
|
||||||
rval->Assign(i, std::move(eventStatRecord));
|
|
||||||
++i;
|
|
||||||
}
|
|
||||||
|
|
||||||
return rval;
|
|
||||||
%}
|
|
||||||
|
|
||||||
function Statistics::start_event_name_statistics_monitor%(%): any
|
|
||||||
%{
|
|
||||||
zeek::plugin::statistics::plugin.StartEventNamesStatisticsMonitor();
|
|
||||||
return nullptr;
|
|
||||||
%}
|
|
|
@ -485,6 +485,11 @@ function get_reporter_stats%(%): ReporterStats
|
||||||
return r;
|
return r;
|
||||||
%}
|
%}
|
||||||
|
|
||||||
|
## Returns a list of event handlers that were called and the number of times
|
||||||
|
## each was called.
|
||||||
|
##
|
||||||
|
## Returns: A record with event call statistics.
|
||||||
|
##
|
||||||
function get_event_handler_call_counts%(%): EventNameStats
|
function get_event_handler_call_counts%(%): EventNameStats
|
||||||
%{
|
%{
|
||||||
auto rval = zeek::make_intrusive<zeek::VectorVal>(zeek::id::find_type<VectorType>("EventNameStats"));
|
auto rval = zeek::make_intrusive<zeek::VectorVal>(zeek::id::find_type<VectorType>("EventNameStats"));
|
||||||
|
|
|
@ -125,7 +125,6 @@ scripts/base/init-frameworks-and-bifs.zeek
|
||||||
build/scripts/base/bif/telemetry.bif.zeek
|
build/scripts/base/bif/telemetry.bif.zeek
|
||||||
build/scripts/base/bif/zeekygen.bif.zeek
|
build/scripts/base/bif/zeekygen.bif.zeek
|
||||||
build/scripts/base/bif/pcap.bif.zeek
|
build/scripts/base/bif/pcap.bif.zeek
|
||||||
build/scripts/base/bif/statistics.bif.zeek
|
|
||||||
build/scripts/base/bif/bloom-filter.bif.zeek
|
build/scripts/base/bif/bloom-filter.bif.zeek
|
||||||
build/scripts/base/bif/cardinality-counter.bif.zeek
|
build/scripts/base/bif/cardinality-counter.bif.zeek
|
||||||
build/scripts/base/bif/top-k.bif.zeek
|
build/scripts/base/bif/top-k.bif.zeek
|
||||||
|
|
|
@ -125,7 +125,6 @@ scripts/base/init-frameworks-and-bifs.zeek
|
||||||
build/scripts/base/bif/telemetry.bif.zeek
|
build/scripts/base/bif/telemetry.bif.zeek
|
||||||
build/scripts/base/bif/zeekygen.bif.zeek
|
build/scripts/base/bif/zeekygen.bif.zeek
|
||||||
build/scripts/base/bif/pcap.bif.zeek
|
build/scripts/base/bif/pcap.bif.zeek
|
||||||
build/scripts/base/bif/statistics.bif.zeek
|
|
||||||
build/scripts/base/bif/bloom-filter.bif.zeek
|
build/scripts/base/bif/bloom-filter.bif.zeek
|
||||||
build/scripts/base/bif/cardinality-counter.bif.zeek
|
build/scripts/base/bif/cardinality-counter.bif.zeek
|
||||||
build/scripts/base/bif/top-k.bif.zeek
|
build/scripts/base/bif/top-k.bif.zeek
|
||||||
|
|
|
@ -935,7 +935,6 @@
|
||||||
0.000000 MetaHookPost LoadFile(0, ./site, <...>/site.zeek) -> -1
|
0.000000 MetaHookPost LoadFile(0, ./site, <...>/site.zeek) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(0, ./smb1-main, <...>/smb1-main.zeek) -> -1
|
0.000000 MetaHookPost LoadFile(0, ./smb1-main, <...>/smb1-main.zeek) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(0, ./smb2-main, <...>/smb2-main.zeek) -> -1
|
0.000000 MetaHookPost LoadFile(0, ./smb2-main, <...>/smb2-main.zeek) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek) -> -1
|
|
||||||
0.000000 MetaHookPost LoadFile(0, ./stats.bif.zeek, <...>/stats.bif.zeek) -> -1
|
0.000000 MetaHookPost LoadFile(0, ./stats.bif.zeek, <...>/stats.bif.zeek) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(0, ./std-dev, <...>/std-dev.zeek) -> -1
|
0.000000 MetaHookPost LoadFile(0, ./std-dev, <...>/std-dev.zeek) -> -1
|
||||||
0.000000 MetaHookPost LoadFile(0, ./store, <...>/store.zeek) -> -1
|
0.000000 MetaHookPost LoadFile(0, ./store, <...>/store.zeek) -> -1
|
||||||
|
@ -1321,7 +1320,6 @@
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./site, <...>/site.zeek) -> (-1, <no content>)
|
0.000000 MetaHookPost LoadFileExtended(0, ./site, <...>/site.zeek) -> (-1, <no content>)
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./smb1-main, <...>/smb1-main.zeek) -> (-1, <no content>)
|
0.000000 MetaHookPost LoadFileExtended(0, ./smb1-main, <...>/smb1-main.zeek) -> (-1, <no content>)
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./smb2-main, <...>/smb2-main.zeek) -> (-1, <no content>)
|
0.000000 MetaHookPost LoadFileExtended(0, ./smb2-main, <...>/smb2-main.zeek) -> (-1, <no content>)
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek) -> (-1, <no content>)
|
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./stats.bif.zeek, <...>/stats.bif.zeek) -> (-1, <no content>)
|
0.000000 MetaHookPost LoadFileExtended(0, ./stats.bif.zeek, <...>/stats.bif.zeek) -> (-1, <no content>)
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./std-dev, <...>/std-dev.zeek) -> (-1, <no content>)
|
0.000000 MetaHookPost LoadFileExtended(0, ./std-dev, <...>/std-dev.zeek) -> (-1, <no content>)
|
||||||
0.000000 MetaHookPost LoadFileExtended(0, ./store, <...>/store.zeek) -> (-1, <no content>)
|
0.000000 MetaHookPost LoadFileExtended(0, ./store, <...>/store.zeek) -> (-1, <no content>)
|
||||||
|
@ -2453,7 +2451,6 @@
|
||||||
0.000000 MetaHookPre LoadFile(0, ./site, <...>/site.zeek)
|
0.000000 MetaHookPre LoadFile(0, ./site, <...>/site.zeek)
|
||||||
0.000000 MetaHookPre LoadFile(0, ./smb1-main, <...>/smb1-main.zeek)
|
0.000000 MetaHookPre LoadFile(0, ./smb1-main, <...>/smb1-main.zeek)
|
||||||
0.000000 MetaHookPre LoadFile(0, ./smb2-main, <...>/smb2-main.zeek)
|
0.000000 MetaHookPre LoadFile(0, ./smb2-main, <...>/smb2-main.zeek)
|
||||||
0.000000 MetaHookPre LoadFile(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek)
|
|
||||||
0.000000 MetaHookPre LoadFile(0, ./stats.bif.zeek, <...>/stats.bif.zeek)
|
0.000000 MetaHookPre LoadFile(0, ./stats.bif.zeek, <...>/stats.bif.zeek)
|
||||||
0.000000 MetaHookPre LoadFile(0, ./std-dev, <...>/std-dev.zeek)
|
0.000000 MetaHookPre LoadFile(0, ./std-dev, <...>/std-dev.zeek)
|
||||||
0.000000 MetaHookPre LoadFile(0, ./store, <...>/store.zeek)
|
0.000000 MetaHookPre LoadFile(0, ./store, <...>/store.zeek)
|
||||||
|
@ -2839,7 +2836,6 @@
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./site, <...>/site.zeek)
|
0.000000 MetaHookPre LoadFileExtended(0, ./site, <...>/site.zeek)
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./smb1-main, <...>/smb1-main.zeek)
|
0.000000 MetaHookPre LoadFileExtended(0, ./smb1-main, <...>/smb1-main.zeek)
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./smb2-main, <...>/smb2-main.zeek)
|
0.000000 MetaHookPre LoadFileExtended(0, ./smb2-main, <...>/smb2-main.zeek)
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek)
|
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./stats.bif.zeek, <...>/stats.bif.zeek)
|
0.000000 MetaHookPre LoadFileExtended(0, ./stats.bif.zeek, <...>/stats.bif.zeek)
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./std-dev, <...>/std-dev.zeek)
|
0.000000 MetaHookPre LoadFileExtended(0, ./std-dev, <...>/std-dev.zeek)
|
||||||
0.000000 MetaHookPre LoadFileExtended(0, ./store, <...>/store.zeek)
|
0.000000 MetaHookPre LoadFileExtended(0, ./store, <...>/store.zeek)
|
||||||
|
@ -3981,7 +3977,6 @@
|
||||||
0.000000 | HookLoadFile ./site <...>/site.zeek
|
0.000000 | HookLoadFile ./site <...>/site.zeek
|
||||||
0.000000 | HookLoadFile ./smb1-main <...>/smb1-main.zeek
|
0.000000 | HookLoadFile ./smb1-main <...>/smb1-main.zeek
|
||||||
0.000000 | HookLoadFile ./smb2-main <...>/smb2-main.zeek
|
0.000000 | HookLoadFile ./smb2-main <...>/smb2-main.zeek
|
||||||
0.000000 | HookLoadFile ./statistics.bif.zeek <...>/statistics.bif.zeek
|
|
||||||
0.000000 | HookLoadFile ./stats.bif.zeek <...>/stats.bif.zeek
|
0.000000 | HookLoadFile ./stats.bif.zeek <...>/stats.bif.zeek
|
||||||
0.000000 | HookLoadFile ./std-dev <...>/std-dev.zeek
|
0.000000 | HookLoadFile ./std-dev <...>/std-dev.zeek
|
||||||
0.000000 | HookLoadFile ./store <...>/store.zeek
|
0.000000 | HookLoadFile ./store <...>/store.zeek
|
||||||
|
@ -4367,7 +4362,6 @@
|
||||||
0.000000 | HookLoadFileExtended ./site <...>/site.zeek
|
0.000000 | HookLoadFileExtended ./site <...>/site.zeek
|
||||||
0.000000 | HookLoadFileExtended ./smb1-main <...>/smb1-main.zeek
|
0.000000 | HookLoadFileExtended ./smb1-main <...>/smb1-main.zeek
|
||||||
0.000000 | HookLoadFileExtended ./smb2-main <...>/smb2-main.zeek
|
0.000000 | HookLoadFileExtended ./smb2-main <...>/smb2-main.zeek
|
||||||
0.000000 | HookLoadFileExtended ./statistics.bif.zeek <...>/statistics.bif.zeek
|
|
||||||
0.000000 | HookLoadFileExtended ./stats.bif.zeek <...>/stats.bif.zeek
|
0.000000 | HookLoadFileExtended ./stats.bif.zeek <...>/stats.bif.zeek
|
||||||
0.000000 | HookLoadFileExtended ./std-dev <...>/std-dev.zeek
|
0.000000 | HookLoadFileExtended ./std-dev <...>/std-dev.zeek
|
||||||
0.000000 | HookLoadFileExtended ./store <...>/store.zeek
|
0.000000 | HookLoadFileExtended ./store <...>/store.zeek
|
||||||
|
|
|
@ -9,7 +9,6 @@ Testing::Plugin2 - Plugin2 provides a load dependency for Plugin1 and Plugin3 (d
|
||||||
in Plugin1
|
in Plugin1
|
||||||
in Plugin2
|
in Plugin2
|
||||||
|
|
||||||
Statistics - Statistics module (built-in)
|
|
||||||
Testing::Plugin1 - Plugin1 has a load dependency on Plugin2 (dynamic, version 1.0.0)
|
Testing::Plugin1 - Plugin1 has a load dependency on Plugin2 (dynamic, version 1.0.0)
|
||||||
Testing::Plugin2 - Plugin2 provides a load dependency for Plugin1 and Plugin3 (dynamic, version 1.0.0)
|
Testing::Plugin2 - Plugin2 provides a load dependency for Plugin1 and Plugin3 (dynamic, version 1.0.0)
|
||||||
Testing::Plugin3 - Plugin3 has a load dependency on Plugin2 (dynamic, version 1.0.0)
|
Testing::Plugin3 - Plugin3 has a load dependency on Plugin2 (dynamic, version 1.0.0)
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue