Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

API updates for metrics framework.

Browse source 
- Removed default logging.  Now a function is available for the new
  $period_finished filter field to get the same behavior for logging
  named Metrics::write_log.

- Added index rollups for getting multiple metrics result values
  as the same time.
This commit is contained in:
Seth Hall 2012-12-18 01:08:59 -05:00
parent 69030fdff3
commit 69b7ce12d2
17 changed files with 304 additions and 162 deletions
Download patch file Download diff file Expand all files Collapse all files

55
scripts/policy/misc/app-metrics.bro
View file

@ -1,49 +1,80 @@
@load base/protocols/http
@load base/protocols/ssl
@load base/frameworks/metrics
module AppMetrics;
export {
## The metric break interval for the default stats collected by this script.
const break_interval = 1hr &redef;
redef enum Log::ID += { LOG };
type Info: record {
ts: time &log;
app: string &log;
uniq_hosts: count &log;
hits: count &log;
bytes: count &log;
};
## The frequency of logging the stats collected by this script.
const break_interval = 1min &redef;
}
function app_metrics_rollup(index: Metrics::Index, vals: table[string, string] of Metrics::ResultVal)
{
local l: Info;
l$ts = network_time();
for ( [metric_name, filter_name] in vals )
{
local val = vals[metric_name, filter_name];
l$app = index$str;
if ( metric_name == "apps.bytes" )
l$bytes = double_to_count(floor(val$sum));
else if ( metric_name == "apps.hits" )
{
l$hits = val$num;
l$uniq_hosts = val$unique;
}
}
Log::write(LOG, l);
}
event bro_init() &priority=3
{
Metrics::add_filter("apps.bytes", [$every=break_interval, $measure=set(Metrics::SUM)]);
Metrics::add_filter("apps.hits", [$every=break_interval, $measure=set(Metrics::SUM, Metrics::UNIQUE)]);
Log::create_stream(AppMetrics::LOG, [$columns=Info]);
Metrics::create_index_rollup("AppMetrics", app_metrics_rollup);
Metrics::add_filter("apps.bytes", [$every=break_interval, $measure=set(Metrics::SUM), $period_finished=Metrics::write_log, $rollup="AppMetrics"]);
Metrics::add_filter("apps.hits", [$every=break_interval, $measure=set(Metrics::UNIQUE), $rollup="AppMetrics"]);
}
function do_metric(id: conn_id, hostname: string, size: count)
{
if ( /youtube/ in hostname && size > 512*1024 )
if ( /youtube\.com$/ in hostname && size > 512*1024 )
{
Metrics::add_data("apps.bytes", [$str="youtube"], [$num=size]);
Metrics::add_data("apps.hits", [$str="youtube"], [$str=cat(id$orig_h)]);
}
else if ( /facebook.com|fbcdn.net/ in hostname && size > 20 )
else if ( /(\.facebook\.com|\.fbcdn\.net)$/ in hostname && size > 20 )
{
Metrics::add_data("apps.bytes", [$str="facebook"], [$num=size]);
Metrics::add_data("apps.hits", [$str="facebook"], [$str=cat(id$orig_h)]);
}
else if ( /google.com/ in hostname && size > 20 )
else if ( /\.google\.com$/ in hostname && size > 20 )
{
Metrics::add_data("apps.bytes", [$str="google"], [$num=size]);
Metrics::add_data("apps.hits", [$str="google"], [$str=cat(id$orig_h)]);
}
else if ( /nflximg.com/ in hostname && size > 200*1024 )
else if ( /nflximg\.com$/ in hostname && size > 200*1024 )
{
Metrics::add_data("apps.bytes", [$str="netflix"], [$num=size]);
Metrics::add_data("apps.hits", [$str="netflix"], [$str=cat(id$orig_h)]);
}
else if ( /pandora.com/ in hostname && size > 512*1024 )
else if ( /\.(pandora|p-cdn)\.com$/ in hostname && size > 512*1024 )
{
Metrics::add_data("apps.bytes", [$str="pandora"], [$num=size]);
Metrics::add_data("apps.hits", [$str="pandora"], [$str=cat(id$orig_h)]);
}
else if ( /gmail.com/ in hostname && size > 20 )
else if ( /gmail\.com$/ in hostname && size > 20 )
{
Metrics::add_data("apps.bytes", [$str="gmail"], [$num=size]);
Metrics::add_data("apps.hits", [$str="gmail"], [$str=cat(id$orig_h)]);
@ -63,7 +94,7 @@ event ssl_established(c: connection)
event connection_finished(c: connection)
{
if ( c?$resp_hostname )
do_metric(c$id, c$resp_hostname, c$resp$num_bytes_ip);
do_metric(c$id, c$resp_hostname, c$resp$size);
}
event HTTP::log_http(rec: HTTP::Info)