Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Small changes for the capture-loss script make the output more understandable.

Browse source
This commit is contained in:
Seth Hall 2011-09-28 11:19:15 -04:00
parent c621da523b
commit 6b52ca5222
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/policy/misc/capture-loss.bro
View file

@ -31,12 +31,12 @@ export {
## to the same host, this distinguishes each peer with it's ## to the same host, this distinguishes each peer with it's
## individual name. ## individual name.
peer: string &log; peer: string &log;
## Number of ACKs seen in the previous measurement interval.
acks: count &log;
## Number of missed ACKs from the previous measurement interval. ## Number of missed ACKs from the previous measurement interval.
gaps: count &log; gaps: count &log;
## Total number of ACKs seen in the previous measurement interval.
acks: count &log;
## Percentage of ACKs seen where the data being ACKed wasn't seen. ## Percentage of ACKs seen where the data being ACKed wasn't seen.
percent_lost: double &log; percent_lost: string &log;
}; };
## The interval at which capture loss reports are created. ## The interval at which capture loss reports are created.
@ -66,11 +66,11 @@ event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps:
$ts_delta=now-last_ts, $ts_delta=now-last_ts,
$peer=peer_description, $peer=peer_description,
$acks=acks, $gaps=gaps, $acks=acks, $gaps=gaps,
$percent_lost=pct_lost]; $percent_lost=fmt("%.3f%%", pct_lost)];
if ( pct_lost >= too_much_loss*100 ) if ( pct_lost >= too_much_loss*100 )
NOTICE([$note=Too_Much_Loss, NOTICE([$note=Too_Much_Loss,
$msg=fmt("The capture loss script detected an estimated loss rate above %.1f%%", pct_lost)]); $msg=fmt("The capture loss script detected an estimated loss rate above %.3f%%", pct_lost)]);
Log::write(LOG, info); Log::write(LOG, info);
schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) }; schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) };