Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/telemetry-net-lag'

Browse source 
* origin/topic/awelzel/telemetry-net-lag:
  stats: Add zeek-net-packet-lag-seconds metric
This commit is contained in:
Arne Welzel 2023-05-24 09:41:01 +02:00
commit 8967e347df
4 changed files with 36 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,3 +1,9 @@
6.0.0-dev.636 | 2023-05-24 09:41:01 +0200
* stats: Add zeek-net-packet-lag-seconds metric (Arne Welzel, Corelight)
* GH-3060: Support negative index lookups for vectors (Tim Wojtulewicz, Corelight)
6.0.0-dev.628 | 2023-05-23 19:32:05 +0200 6.0.0-dev.628 | 2023-05-23 19:32:05 +0200
* ci: Disable openh264 repository on tumbleweed (Arne Welzel, Corelight) * ci: Disable openh264 repository on tumbleweed (Arne Welzel, Corelight)

12
NEWS
View file

@ -161,6 +161,18 @@ New Functionality
- Add logging metrics for streams (``zeek-log-stream-writes``) and writers - Add logging metrics for streams (``zeek-log-stream-writes``) and writers
(``zeek-log-writer-writes-total``). (``zeek-log-writer-writes-total``).
- Add networking metrics via the telemetry framework. These are enabled
when the ``misc/stats`` script is loaded.
zeek-net-dropped-packets
zeek-net-link-packets
zeek-net-received-bytes
zeek-net-packet-lag-seconds
zeek-net-received-packets-total
Except for lag, metrics originate from the ``get_net_stats()`` bif and are
updated through the ``Telemetry::sync()`` hook every 15 seconds by default.
- The DNS analyzer now parses RFC 2535's AD ("authentic data") and CD ("checking - The DNS analyzer now parses RFC 2535's AD ("authentic data") and CD ("checking
disabled") flags from DNS requests and responses, making them available in disabled") flags from DNS requests and responses, making them available in
the ``dns_msg`` record provided by many of the ``dns_*`` events. The existing the ``dns_msg`` record provided by many of the ``dns_*`` events. The existing

2
VERSION
View file

@ -1 +1 @@
6.0.0-dev.632 6.0.0-dev.636

23
scripts/policy/misc/stats.zeek
View file

@ -123,22 +123,33 @@ global packets_filtered_cf = Telemetry::register_counter_family([
$help_text="Total number of packets filtered", $help_text="Total number of packets filtered",
]); ]);
global packet_lag_gf = Telemetry::register_gauge_family([
$prefix="zeek",
$name="net-packet-lag",
$unit="seconds",
$help_text="Difference of network time and wallclock time in seconds.",
]);
global no_labels: vector of string;
hook Telemetry::sync() { hook Telemetry::sync() {
local net_stats = get_net_stats(); local net_stats = get_net_stats();
Telemetry::counter_family_set(bytes_received_cf, vector(), net_stats$bytes_recvd); Telemetry::counter_family_set(bytes_received_cf, no_labels, net_stats$bytes_recvd);
Telemetry::counter_family_set(packets_received_cf, vector(), net_stats$pkts_recvd); Telemetry::counter_family_set(packets_received_cf, no_labels, net_stats$pkts_recvd);
if ( reading_live_traffic() ) if ( reading_live_traffic() )
{ {
Telemetry::counter_family_set(packets_dropped_cf, vector(), net_stats$pkts_dropped); Telemetry::counter_family_set(packets_dropped_cf, no_labels, net_stats$pkts_dropped);
Telemetry::counter_family_set(link_packets_cf, vector(), net_stats$pkts_link); Telemetry::counter_family_set(link_packets_cf, no_labels, net_stats$pkts_link);
if ( net_stats?$pkts_filtered ) if ( net_stats?$pkts_filtered )
Telemetry::counter_family_set(packets_filtered_cf, vector(), net_stats$pkts_filtered); Telemetry::counter_family_set(packets_filtered_cf, no_labels, net_stats$pkts_filtered);
Telemetry::gauge_family_set(packet_lag_gf, no_labels,
interval_to_double(current_time() - network_time()));
} }
} }
event zeek_init() &priority=5 event zeek_init() &priority=5
{ {
Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats", $policy=log_policy]); Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats", $policy=log_policy]);