Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

external/testing-setup: Less telemetry.log volume

Browse source 
For traces spanning a long time period, don't produce immense
amounts of logs. Also filter down the event handler invocation
entries to connection related events in telemetry.log.
This commit is contained in:
Arne Welzel 2023-02-07 10:53:17 +01:00
parent 56a8b99965
commit d9e5cc3078
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
testing/external/scripts/testing-setup.zeek vendored
View file

@ -16,6 +16,10 @@
# Exclude process metrics, they are non-deterministic. # Exclude process metrics, they are non-deterministic.
redef Telemetry::log_prefixes -= { "process" }; redef Telemetry::log_prefixes -= { "process" };
# Increase default telemetry.log 30x to reduce log size
# for traces spanning a long time period.
redef Telemetry::log_interval = 1800sec;
# Prevent the version_info metric from being logged as it's not deterministic. # Prevent the version_info metric from being logged as it's not deterministic.
hook Telemetry::log_policy(rec: Telemetry::Info, id: Log::ID, filter: Log::Filter) hook Telemetry::log_policy(rec: Telemetry::Info, id: Log::ID, filter: Log::Filter)
{ {
@ -23,6 +27,19 @@ hook Telemetry::log_policy(rec: Telemetry::Info, id: Log::ID, filter: Log::Filte
break; break;
} }
# Filter out veto metrics and also loaded_script logs and telemetry logs due
# depending on the configuration (heavily).
hook Telemetry::log_policy(rec: Telemetry::Info, id: Log::ID, filter: Log::Filter)
{
if ( rec$prefix != "zeek" )
return;
# Filter all event-handler-invocations entries from telemetry.log
# except those having something to do with connections.
if ( rec$name == "event-handler-invocations" && /connection_.*/ !in cat(rec$label_values) )
break;
}
# The IMAP analyzer includes absolute filenames in its error messages, # The IMAP analyzer includes absolute filenames in its error messages,
# exclude it for now from analyzer.log. # exclude it for now from analyzer.log.
# https://github.com/zeek/zeek/issues/2659 # https://github.com/zeek/zeek/issues/2659