Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 09:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Now the standalone sumstats works even if Bro is shutting down by blocking.

Browse source
This commit is contained in:
Seth Hall 2014-03-17 16:45:36 -04:00
parent af36915186
commit a07a40dc86
2 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/frameworks/sumstats/non-cluster.bro
View file

@ -37,7 +37,19 @@ event SumStats::finish_epoch(ss: SumStat)
if ( ss?$epoch_result ) if ( ss?$epoch_result )
{ {
local data = result_store[ss$name]; local data = result_store[ss$name];
event SumStats::process_epoch_result(ss, network_time(), data); local now = network_time();
if ( bro_is_terminating() )
{
for ( key in data )
ss$epoch_result(now, key, data[key]);
if ( ss?$epoch_finished )
ss$epoch_finished(now);
}
else
{
event SumStats::process_epoch_result(ss, now, data);
}
} }
# We can reset here because we know that the reference # We can reset here because we know that the reference

3
testing/btest/scripts/base/frameworks/sumstats/basic.bro
View file

@ -23,8 +23,7 @@ event bro_init() &priority=5
local r = result["test.metric"]; local r = result["test.metric"];
print fmt("Host: %s - num:%d - sum:%.1f - var:%.1f - avg:%.1f - max:%.1f - min:%.1f - std_dev:%.1f - unique:%d - hllunique:%d", key$host, r$num, r$sum, r$variance, r$average, r$max, r$min, r$std_dev, r$unique, r$hll_unique); print fmt("Host: %s - num:%d - sum:%.1f - var:%.1f - avg:%.1f - max:%.1f - min:%.1f - std_dev:%.1f - unique:%d - hllunique:%d", key$host, r$num, r$sum, r$variance, r$average, r$max, r$min, r$std_dev, r$unique, r$hll_unique);
terminate(); terminate();
} }]);
])
SumStats::observe("test.metric", [$host=1.2.3.4], [$num=5]); SumStats::observe("test.metric", [$host=1.2.3.4], [$num=5]);
SumStats::observe("test.metric", [$host=1.2.3.4], [$num=22]); SumStats::observe("test.metric", [$host=1.2.3.4], [$num=22]);