Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

change plugin after feedback of seth

Browse source
This commit is contained in:
Bernhard Amann 2013-04-10 10:45:45 -04:00
parent 07d44f3aa0
commit f10ed9e29a
2 changed files with 19 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

25
scripts/base/frameworks/measurement/plugins/hll_unique.bro
View file

@ -10,14 +10,23 @@ export {
redef record ResultVal += { redef record ResultVal += {
## If cardinality is being tracked, the number of unique ## If cardinality is being tracked, the number of unique
## items is tracked here. ## items is tracked here.
hllunique: opaque of cardinality &default=hll_cardinality_init(0.01); hllunique: count &default=0;
}; };
} }
redef record ResultVal += {
# Internal use only. This is not meant to be publically available
# because probabilistic data structures have to be examined using
# specialized bifs.
card: opaque of cardinality &default=hll_cardinality_init(0.01);
};
hook init_resultval_hook(r: Reducer, rv: ResultVal) hook init_resultval_hook(r: Reducer, rv: ResultVal)
{ {
if ( HLLUNIQUE in r$apply && ! rv?$hllunique ) if ( HLLUNIQUE in r$apply && ! rv?$card )
rv$hllunique = hll_cardinality_init(0.01); rv$card = hll_cardinality_init(0.01);
rv$hllunique = 0;
} }
@ -25,15 +34,17 @@ hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal
{ {
if ( HLLUNIQUE in r$apply ) if ( HLLUNIQUE in r$apply )
{ {
hll_cardinality_add(rv$hllunique, data); hll_cardinality_add(rv$card, data);
rv$hllunique = double_to_count(hll_cardinality_estimate(rv$card));
} }
} }
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{ {
local rhll = hll_cardinality_init(0.01); local rhll = hll_cardinality_init(0.01);
hll_cardinality_merge_into(rhll, rv1$hllunique); hll_cardinality_merge_into(rhll, rv1$card);
hll_cardinality_merge_into(rhll, rv2$hllunique); hll_cardinality_merge_into(rhll, rv2$card);
result$hllunique = rhll; result$card = rhll;
result$hllunique = double_to_count(hll_cardinality_estimate(rhll));
} }

2
testing/btest/scripts/base/frameworks/measurement/basic.bro
View file

@ -19,7 +19,7 @@ event bro_init() &priority=5
for ( key in data ) for ( key in data )
{ {
local r = data[key]["test.metric"]; local r = data[key]["test.metric"];
print fmt("Host: %s - num:%d - sum:%.1f - var:%.1f - avg:%.1f - max:%.1f - min:%.1f - std_dev:%.1f - unique:%d - hllunique:%.1f", key$host, r$num, r$sum, r$variance, r$average, r$max, r$min, r$std_dev, r$unique, hll_cardinality_estimate(r$hllunique)); print fmt("Host: %s - num:%d - sum:%.1f - var:%.1f - avg:%.1f - max:%.1f - min:%.1f - std_dev:%.1f - unique:%d - hllunique:%d", key$host, r$num, r$sum, r$variance, r$average, r$max, r$min, r$std_dev, r$unique, r$hllunique);
} }
} }
]); ]);