Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Continued stats cleanup and extension.

Browse source
This commit is contained in:
Seth Hall 2016-01-09 01:14:13 -05:00
parent 3c71d4ffa8
commit cfdabb901f
9 changed files with 59 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/base/init-bare.bro
View file

@ -502,8 +502,8 @@ type ProcStats: record {
};
type EventStats: record {
num_events_queued: count; ##< Total number of events queued so far.
num_events_dispatched: count; ##< Total number of events dispatched so far.
queued: count; ##< Total number of events queued so far.
dispatched: count; ##< Total number of events dispatched so far.
};
## Summary statistics of all regular expression matchers.
@ -520,13 +520,13 @@ type ReassemblerStats: record {
##
## .. bro:see:: get_matcher_stats
type MatcherStats: record {
matchers: count; ##< Number of distinct RE matchers.
dfa_states: count; ##< Number of DFA states across all matchers.
computed: count; ##< Number of computed DFA state transitions.
mem: count; ##< Number of bytes used by DFA states.
hits: count; ##< Number of cache hits.
misses: count; ##< Number of cache misses.
avg_nfa_states: count; ##< Average number of NFA states across all matchers.
matchers: count; ##< Number of distinct RE matchers.
nfa_states: count; ##< Number of NFA states across all matchers.
dfa_states: count; ##< Number of DFA states across all matchers.
computed: count; ##< Number of computed DFA state transitions.
mem: count; ##< Number of bytes used by DFA states.
hits: count; ##< Number of cache hits.
misses: count; ##< Number of cache misses.
};
type TimerStats: record {
@ -560,10 +560,6 @@ type GapStats: record {
gap_bytes: count; ##< How many bytes were missing in the gaps.
};
type PatternStats: record {
};
type ThreadStats: record {
num_threads: count;
};

4
scripts/policy/misc/stats.bro
View file

@ -117,8 +117,8 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr
$reassem_frag_size=rs$frag_size,
$reassem_unknown_size=rs$unknown_size,
$events_proc=es$num_events_dispatched - last_es$num_events_dispatched,
$events_queued=es$num_events_queued - last_es$num_events_queued,
$events_proc=es$dispatched - last_es$dispatched,
$events_queued=es$queued - last_es$queued,
$timers=ts$cumulative - last_ts$cumulative,
$active_timers=ts$current,

5
src/DFA.cc
View file

@ -9,8 +9,6 @@
unsigned int DFA_State::transition_counter = 0;
uint64 total_dfa_states = 0;
DFA_State::DFA_State(int arg_state_num, const EquivClass* ec,
NFA_state_list* arg_nfa_states,
AcceptingSet* arg_accept)
@ -22,8 +20,6 @@ DFA_State::DFA_State(int arg_state_num, const EquivClass* ec,
mark = 0;
centry = 0;
++total_dfa_states;
SymPartition(ec);
xtions = new DFA_State*[num_sym];
@ -350,6 +346,7 @@ DFA_State* DFA_State_Cache::Lookup(const NFA_state_list& nfas,
++misses;
return 0;
}
++hits;
delete *hash;
*hash = 0;

7
src/DFA.h
View file

@ -19,8 +19,6 @@ class DFA_Machine;
class DFA_State;
struct CacheEntry;
extern uint64 total_dfa_states;
class DFA_State : public BroObj {
public:
DFA_State(int state_num, const EquivClass* ec,
@ -91,10 +89,9 @@ public:
int NumEntries() const { return states.Length(); }
struct Stats {
unsigned int dfa_states;
// Sum over all NFA states per DFA state.
// Sum of all NFA states
unsigned int nfa_states;
unsigned int dfa_states;
unsigned int computed;
unsigned int uncomputed;
unsigned int mem;

1
src/Func.cc
View file

@ -653,7 +653,6 @@ void init_builtin_funcs()
TimerStats = internal_type("TimerStats")->AsRecordType();
FileAnalysisStats = internal_type("FileAnalysisStats")->AsRecordType();
ThreadStats = internal_type("ThreadStats")->AsRecordType();
PatternStats = internal_type("PatternStats")->AsRecordType();
var_sizes = internal_type("var_sizes")->AsTableType();

9
src/RuleMatcher.cc
View file

@ -1174,7 +1174,7 @@ void RuleMatcher::GetStats(Stats* stats, RuleHdrTest* hdr_test)
stats->mem = 0;
stats->hits = 0;
stats->misses = 0;
stats->avg_nfa_states = 0;
stats->nfa_states = 0;
hdr_test = root;
}
@ -1195,15 +1195,10 @@ void RuleMatcher::GetStats(Stats* stats, RuleHdrTest* hdr_test)
stats->mem += cstats.mem;
stats->hits += cstats.hits;
stats->misses += cstats.misses;
stats->avg_nfa_states += cstats.nfa_states;
stats->nfa_states += cstats.nfa_states;
}
}
if ( stats->dfa_states )
stats->avg_nfa_states /= stats->dfa_states;
else
stats->avg_nfa_states = 0;
for ( RuleHdrTest* h = hdr_test->child; h; h = h->sibling )
GetStats(stats, h);
}

6
src/RuleMatcher.h
View file

@ -297,6 +297,9 @@ public:
struct Stats {
unsigned int matchers; // # distinct RE matchers
// NFA states across all matchers.
unsigned int nfa_states;
// # DFA states across all matchers
unsigned int dfa_states;
unsigned int computed; // # computed DFA state transitions
@ -305,9 +308,6 @@ public:
// # cache hits (sampled, multiply by MOVE_TO_FRONT_SAMPLE_SIZE)
unsigned int hits;
unsigned int misses; // # cache misses
// Average # NFA states per DFA state.
unsigned int avg_nfa_states;
};
Val* BuildRuleStateValue(const Rule* rule,

6
src/Stats.cc
View file

@ -173,9 +173,9 @@ void ProfileLogger::Log()
RuleMatcher::Stats stats;
rule_matcher->GetStats(&stats);
file->Write(fmt("%06f RuleMatcher: matchers=%d dfa_states=%d ncomputed=%d "
"mem=%dK avg_nfa_states=%d\n", network_time, stats.matchers,
stats.dfa_states, stats.computed, stats.mem / 1024, stats.avg_nfa_states));
file->Write(fmt("%06f RuleMatcher: matchers=%d nfa_states=%d dfa_states=%d "
"ncomputed=%d mem=%dK\n", network_time, stats.matchers,
stats.nfa_states, stats.dfa_states, stats.computed, stats.mem / 1024));
}
file->Write(fmt("%.06f Timers: current=%d max=%d mem=%dK lag=%.2fs\n",

60
src/stats.bif
View file

@ -12,7 +12,6 @@ RecordType* ConnStats;
RecordType* GapStats;
RecordType* EventStats;
RecordType* ThreadStats;
RecordType* PatternStats;
RecordType* TimerStats;
RecordType* FileAnalysisStats;
%%}
@ -157,6 +156,13 @@ function get_event_stats%(%): EventStats
return r;
%}
## Returns statistics about reassembler usage.
##
## Returns: A record with reassembler statistics.
##
## .. bro:see:: get_net_stats
## get_proc_stats
## get_matcher_stats
function get_reassembler_stats%(%): ReassemblerStats
%{
RecordVal* r = new RecordVal(ReassemblerStats);
@ -170,6 +176,13 @@ function get_reassembler_stats%(%): ReassemblerStats
return r;
%}
## Returns statistics about DNS lookup activity.
##
## Returns: A record with DNS lookup statistics.
##
## .. bro:see:: get_net_stats
## get_proc_stats
## get_matcher_stats
function get_dns_stats%(%): DNSStats
%{
RecordVal* r = new RecordVal(DNSStats);
@ -188,25 +201,13 @@ function get_dns_stats%(%): DNSStats
return r;
%}
function get_pattern_stats%(%): PatternStats
%{
RecordVal* r = new RecordVal(PatternStats);
int n = 0;
//DFA_State_Cache::Stats stats;
//dfa_state_cache->GetStats(&stats);
//fprintf(f, "Computed dfa_states = %d; Classes = %d; Computed trans. = %d; Uncomputed trans. = %d\n",
// stats.dfa_states, EC()->NumClasses(),
// stats.computed, stats.uncomputed);
//
//fprintf(f, "DFA cache hits = %d; misses = %d\n",
// stats.hits, stats.misses);
return r;
%}
## Returns statistics about timer usage.
##
## Returns: A record with timer usage statistics.
##
## .. bro:see:: get_net_stats
## get_proc_stats
## get_matcher_stats
function get_timer_stats%(%): TimerStats
%{
RecordVal* r = new RecordVal(TimerStats);
@ -219,6 +220,13 @@ function get_timer_stats%(%): TimerStats
return r;
%}
## Returns statistics about file analysis.
##
## Returns: A record with file analysis statistics.
##
## .. bro:see:: get_net_stats
## get_proc_stats
## get_matcher_stats
function get_file_analysis_stats%(%): FileAnalysisStats
%{
RecordVal* r = new RecordVal(FileAnalysisStats);
@ -231,6 +239,13 @@ function get_file_analysis_stats%(%): FileAnalysisStats
return r;
%}
## Returns statistics about thread usage.
##
## Returns: A record with thread usage statistics.
##
## .. bro:see:: get_net_stats
## get_proc_stats
## get_matcher_stats
function get_thread_stats%(%): ThreadStats
%{
RecordVal* r = new RecordVal(ThreadStats);
@ -245,8 +260,7 @@ function get_thread_stats%(%): ThreadStats
##
## Returns: A record with TCP gap statistics.
##
## .. bro:see:: do_profiling
## get_net_stats
## .. bro:see:: get_net_stats
## get_proc_stats
## get_matcher_stats
function get_gap_stats%(%): GapStats
@ -283,12 +297,12 @@ function get_matcher_stats%(%): MatcherStats
rule_matcher->GetStats(&s);
r->Assign(n++, new Val(s.matchers, TYPE_COUNT));
r->Assign(n++, new Val(s.nfa_states, TYPE_COUNT));
r->Assign(n++, new Val(s.dfa_states, TYPE_COUNT));
r->Assign(n++, new Val(s.computed, TYPE_COUNT));
r->Assign(n++, new Val(s.mem, TYPE_COUNT));
r->Assign(n++, new Val(s.hits, TYPE_COUNT));
r->Assign(n++, new Val(s.misses, TYPE_COUNT));
r->Assign(n++, new Val(s.avg_nfa_states, TYPE_COUNT));
return r;
%}