mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
API updates for metrics framework.
- Removed default logging. Now a function is available for the new $period_finished filter field to get the same behavior for logging named Metrics::write_log. - Added index rollups for getting multiple metrics result values as the same time.
This commit is contained in:
Seth Hall
parent
69030fdff3
commit
69b7ce12d2
17 changed files with 304 additions and 162 deletions
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path metrics
|
||||
#open 2012-12-04-15-53-23
|
||||
#fields ts ts_delta filter_name metric index.str index.host index.network result.begin result.end result.num result.sum result.min result.max result.avg result.variance result.std_dev result.unique
|
||||
#types time interval string string string addr subnet time time count double double double double double double count
|
||||
1354636403.682565 3.000000 default test.metric - 6.5.4.3 - 1354636401.774655 1354636401.782720 2 6.0 1.0 5.0 3.0 4.0 2.0 -
|
||||
1354636403.682565 3.000000 default test.metric - 1.2.3.4 - 1354636401.774655 1354636401.782720 9 437.0 3.0 95.0 48.555556 674.469136 25.970544 -
|
||||
1354636403.682565 3.000000 default test.metric - 7.2.1.5 - 1354636401.774655 1354636401.782720 2 145.0 54.0 91.0 72.5 342.25 18.5 -
|
||||
#close 2012-12-04-15-53-23
|
||||
#open 2012-12-17-18-43-15
|
||||
#fields ts ts_delta metric index.str index.host index.network result.begin result.end result.num result.sum result.min result.max result.avg result.variance result.std_dev result.unique
|
||||
#types time interval string string addr subnet time time count double double double double double double count
|
||||
1355769795.365325 3.000000 test.metric - 6.5.4.3 - 1355769793.449322 1355769793.458467 2 6.0 1.0 5.0 3.0 4.0 2.0 2
|
||||
1355769795.365325 3.000000 test.metric - 1.2.3.4 - 1355769793.449322 1355769793.458467 9 437.0 3.0 95.0 48.555556 674.469136 25.970544 8
|
||||
1355769795.365325 3.000000 test.metric - 7.2.1.5 - 1355769793.449322 1355769793.458467 2 145.0 54.0 91.0 72.5 342.25 18.5 2
|
||||
#close 2012-12-17-18-43-21
|
||||
|
|
|
|||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path metrics
|
||||
#open 2012-12-04-15-55-13
|
||||
#fields ts ts_delta filter_name metric index.str index.host index.network result.begin result.end result.num result.sum result.min result.max result.avg result.variance result.std_dev result.unique
|
||||
#types time interval string string string addr subnet time time count double double double double double double count
|
||||
1354636513.492214 3.000000 foo-bar test.metric - 6.5.4.3 - 1354636513.492214 1354636513.492214 1 2.0 2.0 2.0 2.0 0.0 0.0 -
|
||||
1354636513.492214 3.000000 foo-bar test.metric - 1.2.3.4 - 1354636513.492214 1354636513.492214 5 221.0 5.0 94.0 44.2 915.36 30.254917 -
|
||||
1354636513.492214 3.000000 foo-bar test.metric - 7.2.1.5 - 1354636513.492214 1354636513.492214 1 1.0 1.0 1.0 1.0 0.0 0.0 -
|
||||
#close 2012-12-04-15-55-13
|
||||
#open 2012-12-17-18-43-45
|
||||
#fields ts ts_delta metric index.str index.host index.network result.begin result.end result.num result.sum result.min result.max result.avg result.variance result.std_dev result.unique
|
||||
#types time interval string string addr subnet time time count double double double double double double count
|
||||
1355769825.947161 3.000000 test.metric - 6.5.4.3 - 1355769825.947161 1355769825.947161 1 2.0 2.0 2.0 2.0 0.0 0.0 -
|
||||
1355769825.947161 3.000000 test.metric - 1.2.3.4 - 1355769825.947161 1355769825.947161 5 221.0 5.0 94.0 44.2 915.36 30.254917 -
|
||||
1355769825.947161 3.000000 test.metric - 7.2.1.5 - 1355769825.947161 1355769825.947161 1 1.0 1.0 1.0 1.0 0.0 0.0 -
|
||||
#close 2012-12-17-18-43-45
|
||||
|
|
|
|||
|
|
@ -19,11 +19,23 @@ redef Cluster::nodes = {
|
|||
|
||||
redef Log::default_rotation_interval = 0secs;
|
||||
|
||||
global n = 0;
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Metrics::add_filter("test.metric",
|
||||
[$every=3secs,
|
||||
$measure=set(Metrics::SUM, Metrics::MIN, Metrics::MAX, Metrics::AVG, Metrics::STD_DEV, Metrics::VARIANCE)]);
|
||||
$measure=set(Metrics::SUM, Metrics::MIN, Metrics::MAX, Metrics::AVG, Metrics::STD_DEV, Metrics::VARIANCE, Metrics::UNIQUE),
|
||||
$period_finished(ts: time, metric_name: string, filter_name: string, data: Metrics::MetricTable) =
|
||||
{
|
||||
Metrics::write_log(ts, metric_name, filter_name, data);
|
||||
if ( ++n == 3 )
|
||||
{
|
||||
terminate_communication();
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
]);
|
||||
}
|
||||
|
||||
event remote_connection_closed(p: event_peer)
|
||||
|
|
@ -64,22 +76,10 @@ event ready_for_data()
|
|||
|
||||
@if ( Cluster::local_node_type() == Cluster::MANAGER )
|
||||
|
||||
global n = 0;
|
||||
global peer_count = 0;
|
||||
|
||||
event Metrics::log_metrics(rec: Metrics::Info)
|
||||
{
|
||||
++n;
|
||||
if ( n == 3 )
|
||||
{
|
||||
terminate_communication();
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event remote_connection_handshake_done(p: event_peer)
|
||||
{
|
||||
print p;
|
||||
++peer_count;
|
||||
if ( peer_count == 3 )
|
||||
event ready_for_data();
|
||||
|
|
|
|||
|
|
@ -6,7 +6,9 @@ event bro_init() &priority=5
|
|||
Metrics::add_filter("test.metric",
|
||||
[$name="foo-bar",
|
||||
$every=3secs,
|
||||
$measure=set(Metrics::SUM, Metrics::VARIANCE, Metrics::AVG, Metrics::MAX, Metrics::MIN, Metrics::STD_DEV)]);
|
||||
$measure=set(Metrics::SUM, Metrics::VARIANCE, Metrics::AVG, Metrics::MAX, Metrics::MIN, Metrics::STD_DEV),
|
||||
$period_finished=Metrics::write_log]);
|
||||
|
||||
Metrics::add_data("test.metric", [$host=1.2.3.4], [$num=5]);
|
||||
Metrics::add_data("test.metric", [$host=1.2.3.4], [$num=22]);
|
||||
Metrics::add_data("test.metric", [$host=1.2.3.4], [$num=94]);
|
||||
|
|
|
|||
|
|
@ -26,8 +26,7 @@ event bro_init() &priority=5
|
|||
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
||||
print "A test metric threshold was crossed!";
|
||||
terminate();
|
||||
}
|
||||
]);
|
||||
}]);
|
||||
}
|
||||
|
||||
event remote_connection_closed(p: event_peer)
|
||||
|
|
|
|||
|
|
@ -15,8 +15,7 @@ event bro_init() &priority=5
|
|||
$threshold=5,
|
||||
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
||||
print fmt("THRESHOLD: hit a threshold value at %.0f for %s", val$sum, Metrics::index2str(index));
|
||||
},
|
||||
$log=F]);
|
||||
}]);
|
||||
|
||||
Metrics::add_filter("test.metric",
|
||||
[$name="foobar2",
|
||||
|
|
@ -25,8 +24,7 @@ event bro_init() &priority=5
|
|||
$threshold_series=vector(3,6,800),
|
||||
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
||||
print fmt("THRESHOLD_SERIES: hit a threshold series value at %.0f for %s", val$sum, Metrics::index2str(index));
|
||||
},
|
||||
$log=F]);
|
||||
}]);
|
||||
Metrics::add_filter("test.metric",
|
||||
[$every=3secs,
|
||||
$measure=set(Metrics::SUM),
|
||||
|
|
@ -36,8 +34,7 @@ event bro_init() &priority=5
|
|||
},
|
||||
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
||||
print fmt("THRESHOLD_FUNC: hit a threshold function value at %.0f for %s", val$sum, Metrics::index2str(index));
|
||||
},
|
||||
$log=F]);
|
||||
}]);
|
||||
|
||||
Metrics::add_data("test.metric", [$host=1.2.3.4], [$num=3]);
|
||||
Metrics::add_data("test.metric", [$host=6.5.4.3], [$num=2]);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue