Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Removed the example metrics scripts. Better real world examples exist now.

Browse source
This commit is contained in:
Seth Hall 2013-04-02 00:15:55 -04:00
parent b477d2b02d
commit d11a1dab73
3 changed files with 0 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/policy/frameworks/metrics/conn-example.bro
View file

@ -1,26 +0,0 @@
##! An example of using the metrics framework to collect connection metrics
##! aggregated into /24 CIDR ranges.
@load base/frameworks/measurement
@load base/utils/site
event bro_init()
{
#Metrics::add_filter("conns.originated", [$aggregation_mask=24, $break_interval=1mins]);
Metrics::add_filter("conns.originated", [$every=1mins, $measure=set(Metrics::SUM),
$aggregation_table=Site::local_nets_table,
$period_finished=Metrics::write_log]);
# Site::local_nets must be defined in order for this to actually do anything.
Metrics::add_filter("conns.responded", [$every=1mins, $measure=set(Metrics::SUM),
$aggregation_table=Site::local_nets_table,
$period_finished=Metrics::write_log]);
}
event connection_established(c: connection)
{
Metrics::add_data("conns.originated", [$host=c$id$orig_h], [$num=1]);
Metrics::add_data("conns.responded", [$host=c$id$resp_h], [$num=1]);
}

29
scripts/policy/frameworks/metrics/http-example.bro
View file

@ -1,29 +0,0 @@
##! Provides an example of aggregating and limiting collection down to
##! only local networks. Additionally, the status code for the response from
##! the request is added into the metric.
@load base/frameworks/measurement
@load base/protocols/http
@load base/utils/site
event bro_init()
{
Metrics::add_filter("http.request.by_host_header",
[$every=1min, $measure=set(Metrics::SUM),
$pred(index: Metrics::Index, data: Metrics::DataPoint) = { return T; return Site::is_local_addr(index$host); },
$aggregation_mask=24,
$period_finished=Metrics::write_log]);
# Site::local_nets must be defined in order for this to actually do anything.
Metrics::add_filter("http.request.by_status_code", [$every=1min, $measure=set(Metrics::SUM),
$aggregation_table=Site::local_nets_table,
$period_finished=Metrics::write_log]);
}
event HTTP::log_http(rec: HTTP::Info)
{
if ( rec?$host )
Metrics::add_data("http.request.by_host_header", [$str=rec$host], [$num=1]);
if ( rec?$status_code )
Metrics::add_data("http.request.by_status_code", [$host=rec$id$orig_h, $str=fmt("%d", rec$status_code)], [$num=1]);
}

23
scripts/policy/frameworks/metrics/ssl-example.bro
View file

@ -1,23 +0,0 @@
##! Provides an example of using the metrics framework to collect the number
##! of times a specific server name indicator value is seen in SSL session
##! establishments. Names ending in google.com are being filtered out as an
##! example of the predicate based filtering in metrics filters.
@load base/frameworks/measurement
@load base/protocols/ssl
event bro_init()
{
Metrics::add_filter("ssl.by_servername",
[$name="no-google-ssl-servers",
$every=10secs, $measure=set(Metrics::SUM),
$pred(index: Metrics::Index, data: Metrics::DataPoint) = {
return (/google\.com$/ !in index$str);
}]);
}
event SSL::log_ssl(rec: SSL::Info)
{
if ( rec?$server_name )
Metrics::add_data("ssl.by_servername", [$str=rec$server_name], [$num=1]);
}