Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: optimize get_file_handle event queueing.

Browse source 
When a file handle is needed and the last event in the queue is also
a get_file_handle event with the same arguments, instead of queueing
a new event, just remember to cache/re-use the resulting handle from
the previous event.  This depends on get_file_handle handlers not
changing global state that is also used to derive the file handle
string.
This commit is contained in:
Jon Siwek 2013-04-02 16:21:51 -05:00
parent 390358b70c
commit fc267d010d
10 changed files with 88 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/file_analysis/Manager.h
View file

@ -130,6 +130,7 @@ protected:
typedef set<string> StrSet;
typedef map<FileID, Info*> IDMap;
typedef queue<PendingFile*> PendingQueue;
typedef queue<int> HandleCache;
/**
* @return the Info object mapped to \a unique or a null pointer if analysis
@ -164,22 +165,24 @@ protected:
*/
bool IsIgnored(const string& unique);
/**
* @return whether file analysis is disabled for the given analyzer.
*/
static bool IsDisabled(AnalyzerTag::Tag tag);
/**
* Queues \c get_file_handle event in order to retrieve unique file handle.
* @return true if there is a handler for the event, else false.
*/
static bool QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
bool is_orig);
bool QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
bool is_orig);
/**
* @return whether file analysis is disabled for the given analyzer.
*/
static bool IsDisabled(AnalyzerTag::Tag tag);
StrMap str_map; /**< Map unique strings to \c FileAnalysis::Info records. */
IDMap id_map; /**< Map file IDs to \c FileAnalysis::Info records. */
StrSet ignored; /**< Ignored files. Will be finally removed on EOF. */
PendingQueue pending; /**< Files awaiting a unique handle. */
HandleCache cache; /**< The number of times a received file handle can be
used to pop the #pending queue. */
static TableVal* disabled; /**< Table of disabled analyzers. */
};