diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index f9633aeabd..f3239c11a3 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -669,16 +669,16 @@ type SYN_packet: record { ## ## .. zeek:see:: get_net_stats type NetStats: record { - pkts_recvd: count &default=0; ##< Packets received by Zeek. - pkts_dropped: count &default=0; ##< Packets reported dropped by the system. + pkts_recvd: count &default=0; ##< Packets received by Zeek. + pkts_dropped: count &default=0; ##< Packets reported dropped by the system. ## Packets seen on the link. Note that this may differ ## from *pkts_recvd* because of a potential capture_filter. See ## :doc:`/scripts/base/frameworks/packet-filter/main.zeek`. Depending on the ## packet capture system, this value may not be available and will then ## be always set to zero. - pkts_link: count &default=0; - bytes_recvd: count &default=0; ##< Bytes received by Zeek. - filtered: count &optional; ##< Packets filtered by the packet source. + pkts_link: count &default=0; + bytes_recvd: count &default=0; ##< Bytes received by Zeek. + pkts_filtered: count &optional; ##< Packets filtered by the packet source. }; type ConnStats: record { diff --git a/scripts/policy/misc/stats.zeek b/scripts/policy/misc/stats.zeek index d9b9ce0d7d..d64406e217 100644 --- a/scripts/policy/misc/stats.zeek +++ b/scripts/policy/misc/stats.zeek @@ -1,6 +1,7 @@ ##! Log memory/packet/lag statistics. @load base/frameworks/notice +@load base/frameworks/telemetry module Stats; @@ -87,6 +88,57 @@ export { global log_stats: event(rec: Info); } +global bytes_received_cf = Telemetry::register_counter_family([ + $prefix="zeek", + $name="net-received-bytes", + $unit="1", + $help_text="Total number of bytes received", +]); + +global packets_received_cf = Telemetry::register_counter_family([ + $prefix="zeek", + $name="net-received-packets", + $unit="1", + $help_text="Total number of packets received", +]); + +global packets_dropped_cf = Telemetry::register_counter_family([ + $prefix="zeek", + $name="net-dropped-packets", + $unit="1", + $help_text="Total number of packets dropped", +]); + +global link_packets_cf = Telemetry::register_counter_family([ + $prefix="zeek", + $name="net-link-packets", + $unit="1", + $help_text="Total number of packets on the packet source link before filtering", +]); + +global packets_filtered_cf = Telemetry::register_counter_family([ + $prefix="zeek", + $name="net-filtered-packets", + $unit="1", + $help_text="Total number of packets filtered", +]); + +hook Telemetry::sync() { + local net_stats = get_net_stats(); + Telemetry::counter_family_set(bytes_received_cf, vector(), net_stats$bytes_recvd); + Telemetry::counter_family_set(packets_received_cf, vector(), net_stats$pkts_recvd); + + if ( reading_live_traffic() ) + { + Telemetry::counter_family_set(packets_dropped_cf, vector(), net_stats$pkts_dropped); + Telemetry::counter_family_set(link_packets_cf, vector(), net_stats$pkts_link); + + if ( net_stats?$pkts_filtered ) + Telemetry::counter_family_set(packets_filtered_cf, vector(), net_stats$pkts_filtered); + } +} + + event zeek_init() &priority=5 { Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats", $policy=log_policy]); diff --git a/src/RunState.cc b/src/RunState.cc index 4791759bf2..ce649491f4 100644 --- a/src/RunState.cc +++ b/src/RunState.cc @@ -432,7 +432,8 @@ void get_final_stats() std::string filtered = ""; if ( s.filtered ) { - double filtered_pct = s.filtered ? pct(s.filtered.value(), s.received) : 0.0; + double filtered_pct = s.filtered.value() > 0 ? pct(s.filtered.value(), s.received) + : 0.0; filtered = zeek::util::fmt(" %" PRIu64 " (%.2f%%) filtered", s.filtered.value(), filtered_pct); } diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h index b4c6fa0dc0..062ac5032b 100644 --- a/src/iosource/PktSrc.h +++ b/src/iosource/PktSrc.h @@ -9,6 +9,7 @@ #include "zeek/iosource/BPF_Program.h" #include "zeek/iosource/IOSource.h" #include "zeek/iosource/Packet.h" +#include "zeek/telemetry/Manager.h" struct pcap_pkthdr; diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing index ff6adb3e7b..3c219f5e9d 100644 --- a/testing/external/commit-hash.zeek-testing +++ b/testing/external/commit-hash.zeek-testing @@ -1 +1 @@ -175be0b929c7f513cdb944f9f20d61274380501e +18a9ac00f5b7617e8660d4ba680a25291d2b44f7 \ No newline at end of file diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private index 68240283bb..72bdde067f 100644 --- a/testing/external/commit-hash.zeek-testing-private +++ b/testing/external/commit-hash.zeek-testing-private @@ -1 +1 @@ -8718f8842f64a4ea97900b5a03380a5417528d1c +98e8aee2f09bff7e8138290242274b5ffd834e58