Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Remove statistics plugin in favor of stats bif

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-11-10 12:39:44 -07:00
parent 3a963f080e
commit 5d5f5de1d1
11 changed files with 7 additions and 137 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/init-bare.zeek
View file

@ -794,7 +794,7 @@ type ReporterStats: record {
## Statistics about how many times each event name is queued.
##
## .. zeek:see:: Statistics::get_and_reset_event_name_statistics
## .. zeek:see:: get_event_handler_call_counts
type EventNameCounter: record {
## Name of the zeek event.
name: string &log;

1
src/CMakeLists.txt
View file

@ -197,7 +197,6 @@ add_subdirectory(file_analysis)
add_subdirectory(input)
add_subdirectory(iosource)
add_subdirectory(logging)
add_subdirectory(statistics)
add_subdirectory(probabilistic)
add_subdirectory(session)

9
src/statistics/CMakeLists.txt
View file

@ -1,9 +0,0 @@
include(ZeekPlugin)
include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
zeek_plugin_begin(Zeek Statistics)
zeek_plugin_cc(Plugin.cc)
bif_target(statistics.bif)
zeek_plugin_end()

57
src/statistics/Plugin.cc
View file

@ -1,57 +0,0 @@
#include "Plugin.h"
#include <mutex>
#include "zeek/Conn.h"
#include "zeek/Desc.h"
#include "zeek/Event.h"
#include "zeek/Func.h"
#include "zeek/RunState.h"
#include "zeek/threading/Formatter.h"
#include "statistics.bif.h"
namespace zeek::plugin::statistics
{
Plugin plugin;
}
using namespace zeek::plugin::statistics;
zeek::plugin::Configuration Plugin::Configure()
{
zeek::plugin::Configuration config;
config.name = "Statistics";
config.description = "Statistics module";
config.version.major = 1;
config.version.minor = 0;
config.version.patch = 0;
return config;
}
bool Plugin::HookQueueEvent(zeek::Event* event)
{
const char* name = event->Handler()->Name();
std::lock_guard<std::mutex> scopedLock(m_lock);
if ( m_eventNameCounters.find(name) == m_eventNameCounters.end() )
{
m_eventNameCounters[name] = 0;
}
m_eventNameCounters[name]++;
return false;
}
std::unordered_map<const char*, int> Plugin::GetAndResetEventStatistics()
{
std::lock_guard<std::mutex> scopedLock(m_lock);
std::unordered_map<const char*, int> result(m_eventNameCounters);
m_eventNameCounters.clear();
return result;
}
void Plugin::StartEventNamesStatisticsMonitor()
{
EnableHook(zeek::plugin::HOOK_QUEUE_EVENT);
}

30
src/statistics/Plugin.h
View file

@ -1,30 +0,0 @@
#pragma once
#include <mutex>
#include <string>
#include <unordered_map>
#include "zeek/plugin/Plugin.h"
namespace zeek::plugin::statistics
{
class Plugin : public zeek::plugin::Plugin
{
protected:
bool HookQueueEvent(zeek::Event* event) override;
zeek::plugin::Configuration Configure() override;
public:
std::unordered_map<const char*, int> GetAndResetEventStatistics();
void StartEventNamesStatisticsMonitor();
private:
std::unordered_map<const char*, int> m_eventNameCounters;
std::mutex m_lock;
};
extern Plugin plugin;
}

29
src/statistics/statistics.bif
View file

@ -1,29 +0,0 @@
%%{
#include "zeek/statistics/Plugin.h"
%%}
function Statistics::get_and_reset_event_name_statistics%(%): EventNameStats
%{
auto rval = zeek::make_intrusive<zeek::VectorVal>(zeek::id::find_type<VectorType>("EventNameStats"));
auto stats = zeek::plugin::statistics::plugin.GetAndResetEventStatistics();
const auto& recordType = zeek::id::find_type<RecordType>("EventNameCounter");
auto i = 0;
for (auto& eventCounter : stats)
{
auto eventStatRecord = zeek::make_intrusive<zeek::RecordVal>(recordType);
eventStatRecord->Assign(0, zeek::make_intrusive<zeek::StringVal>(eventCounter.first));
eventStatRecord->Assign(1, zeek::val_mgr->Count(eventCounter.second));
rval->Assign(i, std::move(eventStatRecord));
++i;
}
return rval;
%}
function Statistics::start_event_name_statistics_monitor%(%): any
%{
zeek::plugin::statistics::plugin.StartEventNamesStatisticsMonitor();
return nullptr;
%}

5
src/stats.bif
View file

@ -485,6 +485,11 @@ function get_reporter_stats%(%): ReporterStats
return r;
%}
## Returns a list of event handlers that were called and the number of times
## each was called.
##
## Returns: A record with event call statistics.
##
function get_event_handler_call_counts%(%): EventNameStats
%{
auto rval = zeek::make_intrusive<zeek::VectorVal>(zeek::id::find_type<VectorType>("EventNameStats"));

1
testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
View file

@ -125,7 +125,6 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/telemetry.bif.zeek
build/scripts/base/bif/zeekygen.bif.zeek
build/scripts/base/bif/pcap.bif.zeek
build/scripts/base/bif/statistics.bif.zeek
build/scripts/base/bif/bloom-filter.bif.zeek
build/scripts/base/bif/cardinality-counter.bif.zeek
build/scripts/base/bif/top-k.bif.zeek

1
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -125,7 +125,6 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/telemetry.bif.zeek
build/scripts/base/bif/zeekygen.bif.zeek
build/scripts/base/bif/pcap.bif.zeek
build/scripts/base/bif/statistics.bif.zeek
build/scripts/base/bif/bloom-filter.bif.zeek
build/scripts/base/bif/cardinality-counter.bif.zeek
build/scripts/base/bif/top-k.bif.zeek

6
testing/btest/Baseline/plugins.hooks/output
View file

@ -935,7 +935,6 @@
0.000000 MetaHookPost LoadFile(0, ./site, <...>/site.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./smb1-main, <...>/smb1-main.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./smb2-main, <...>/smb2-main.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./stats.bif.zeek, <...>/stats.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./std-dev, <...>/std-dev.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./store, <...>/store.zeek) -> -1
@ -1321,7 +1320,6 @@
0.000000 MetaHookPost LoadFileExtended(0, ./site, <...>/site.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./smb1-main, <...>/smb1-main.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./smb2-main, <...>/smb2-main.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./stats.bif.zeek, <...>/stats.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./std-dev, <...>/std-dev.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./store, <...>/store.zeek) -> (-1, <no content>)
@ -2453,7 +2451,6 @@
0.000000 MetaHookPre LoadFile(0, ./site, <...>/site.zeek)
0.000000 MetaHookPre LoadFile(0, ./smb1-main, <...>/smb1-main.zeek)
0.000000 MetaHookPre LoadFile(0, ./smb2-main, <...>/smb2-main.zeek)
0.000000 MetaHookPre LoadFile(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./stats.bif.zeek, <...>/stats.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./std-dev, <...>/std-dev.zeek)
0.000000 MetaHookPre LoadFile(0, ./store, <...>/store.zeek)
@ -2839,7 +2836,6 @@
0.000000 MetaHookPre LoadFileExtended(0, ./site, <...>/site.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./smb1-main, <...>/smb1-main.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./smb2-main, <...>/smb2-main.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./statistics.bif.zeek, <...>/statistics.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./stats.bif.zeek, <...>/stats.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./std-dev, <...>/std-dev.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./store, <...>/store.zeek)
@ -3981,7 +3977,6 @@
0.000000 | HookLoadFile ./site <...>/site.zeek
0.000000 | HookLoadFile ./smb1-main <...>/smb1-main.zeek
0.000000 | HookLoadFile ./smb2-main <...>/smb2-main.zeek
0.000000 | HookLoadFile ./statistics.bif.zeek <...>/statistics.bif.zeek
0.000000 | HookLoadFile ./stats.bif.zeek <...>/stats.bif.zeek
0.000000 | HookLoadFile ./std-dev <...>/std-dev.zeek
0.000000 | HookLoadFile ./store <...>/store.zeek
@ -4367,7 +4362,6 @@
0.000000 | HookLoadFileExtended ./site <...>/site.zeek
0.000000 | HookLoadFileExtended ./smb1-main <...>/smb1-main.zeek
0.000000 | HookLoadFileExtended ./smb2-main <...>/smb2-main.zeek
0.000000 | HookLoadFileExtended ./statistics.bif.zeek <...>/statistics.bif.zeek
0.000000 | HookLoadFileExtended ./stats.bif.zeek <...>/stats.bif.zeek
0.000000 | HookLoadFileExtended ./std-dev <...>/std-dev.zeek
0.000000 | HookLoadFileExtended ./store <...>/store.zeek

1
testing/btest/Baseline/plugins.plugin-load-dependency/output
View file

@ -9,7 +9,6 @@ Testing::Plugin2 - Plugin2 provides a load dependency for Plugin1 and Plugin3 (d
in Plugin1
in Plugin2
Statistics - Statistics module (built-in)
Testing::Plugin1 - Plugin1 has a load dependency on Plugin2 (dynamic, version 1.0.0)
Testing::Plugin2 - Plugin2 provides a load dependency for Plugin1 and Plugin3 (dynamic, version 1.0.0)
Testing::Plugin3 - Plugin3 has a load dependency on Plugin2 (dynamic, version 1.0.0)