Commit graph

96 commits

Author SHA1 Message Date
Jon Siwek
6323b0a8c2 Remove an extraneous Zeekygen-style comment 2020-12-04 19:20:57 -08:00
Johanna Amann
47ceac2491 Merge remote-tracking branch 'origin/topic/johanna/GH-348'
* origin/topic/johanna/GH-348:
  Sumstats: allow users to manage epoch manually
  Sumstats: epoch_finished was not called under certain circumstances
2020-12-04 18:49:53 +00:00
Johanna Amann
7362f30c3a Sumstats: allow users to manage epoch manually
This change allows users to specify an epoch length of 0, which means
that the user manually has to finish the epochs. A new next_epoch
function is introduced to allow users to manually end epochs.

Addresses GH-348
2020-11-16 15:48:46 +00:00
Johanna Amann
8ffbc69a4d Sumstats: epoch_finished was not called under certain circumstances
In non-clustered mode, epoch_finished was not called when there was no
data during the epoch.

This behavior does not fit the documentation, and also is different in
cluster-mode, where epoch_finished is, indeed, called after every epoch.

This small change fixes this behavior.
2020-11-16 15:36:50 +00:00
Tim Wojtulewicz
b8287a3375 Fix issue with sumstats script and fix baselines that were crashing previously 2020-08-09 21:13:12 -07:00
Jon Siwek
dfed213f31 Deprecate functions with "bro" in them.
* "bro_is_terminating" is now "zeek_is_terminating"

* "bro_version" is now "zeek_version"

The old function names still exist for now, but are deprecated.
2019-06-05 16:18:57 -07:00
Jon Siwek
aebcb1415d GH-234: rename Broxygen to Zeexygen along with roles/directives
* All "Broxygen" usages have been replaced in
  code, documentation, filenames, etc.

* Sphinx roles/directives like ":bro:see" are now ":zeek:see"

* The "--broxygen" command-line option is now "--zeexygen"
2019-04-22 19:45:50 -07:00
Jon Siwek
a994be9eeb Merge remote-tracking branch 'origin/topic/seth/zeek_init'
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Seth Hall
8cefb9be42 Implement the zeek_init handler.
Implements the change and a test.
2019-04-14 08:37:35 -04:00
Daniel Thayer
18bd74454b Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
Jon Siwek
01d303b480 Migrate table-based for-loops to key-value iteration 2019-03-15 19:54:44 -07:00
Jon Siwek
01e17b5ea0 Fix SumStats "last" plugin in cluster mode 2018-11-08 12:27:37 -06:00
Jon Siwek
5821c16490 Fix SumStats::observe key normalization logic
The loop over Reducers in SumStats::observe performs a key normalization
and inadvertently modifies the key used for subsequent iterations.

Reported by Jim Mellander.
2018-08-13 17:53:26 -05:00
Vern Paxson
88fd7510c6 reap the fruits of v += e 2018-07-26 12:51:36 -07:00
Robin Sommer
fe7e1ee7f0 Merge topic/actor-system throug a squashed commit. 2018-05-18 22:39:23 +00:00
Jon Siwek
3495b2fa9d Fix problems with SumStats non-cluster.bro script
* Add proper namespace scoping to a 'SumStats::process_epoch_result'
  scheduled event.

* Fix iterator invalidation within 'SumStats::process_epoch_result'

* Give 'SumStats::process_epoch_result' a copy of the result table so
  that the SumStats framework can clear the original and move on to the
  next epoch immediately.

* The previous baseline of the basic sumstats unit test did look wrong
  to me and probably was actually indicative of the iterator invalidation
  problem.

Thanks to Jim Mellander for reporting the issues.
2018-01-18 11:14:39 -06:00
Justin Azoff
f80f2f2a08 Track outstanding_global_views updates by uid
Currently outstanding_global_views values are only decremented during
the end of epoch cleanup, but not when handle_end_of_result_collection
is called for the specific uid that actually triggered the result
collection (which is specifically NOT a cleanup event).

This changes outstanding_global_views values to be a set of outstanding
uids, instead of a count.  This allows handle_end_of_result_collection
to remove any uids from the set as it sees them.
2016-07-29 12:54:20 -04:00
Justin Azoff
1f7f16be9d Also track recent_global_view_keys on manager
Previously, recent_global_view_keys was only tracked on workers causing
a popular key to be sent up and handled by the manager once for each
worker.

This records the key inside recent_global_view_keys on the manager after
the first update, making the rest of the updates no-ops.

Additionally, since the counter value was never used, it has been
changed from a table to a set.
2016-07-29 12:26:04 -04:00
Daniel Thayer
7ede9c65d2 Add more documentation to sumstats framework scripts 2016-03-01 17:31:41 -06:00
Bernhard Amann
b283883997 define empty request_key method for sumstats in cluster mode.
This prevents the worker nodes from crashing, when request_key is used
in cluster mode and called on the worker and the manager nodes (i.e. when
a non-cluster-aware script is used).

Addresses BIT-1177
2014-04-18 16:29:51 -07:00
Bernhard Amann
9438bc166b change the sumstats table that tracks recent intermediate requests
back to create interval.

In this instance a read expiry actually makes much less sense.
2014-04-03 13:52:26 -07:00
Bernhard Amann
254dd85bff Change all &create_expire attributes to &read_expire in the cluster
part of the sumstats framework.

This seems to fix a few rare problems.
2014-03-28 10:57:45 -07:00
Seth Hall
a07a40dc86 Now the standalone sumstats works even if Bro is shutting down by blocking. 2014-03-17 16:45:36 -04:00
Seth Hall
af36915186 Change the standalone sumstats mode to work incrementally. 2014-03-17 16:06:14 -04:00
Daniel Thayer
72a4a90416 Add more script package README files
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.
2013-10-23 16:36:14 -05:00
Daniel Thayer
e724e5d392 Do not include documentation of commented-out items
Some documentation of commented-out items was being output to HTML,
which was causing that documentation to be merged with the
documentation of the next item.  Fixed by changing "##" to "#" so
that the doc comments are not included in the HTML.
2013-10-22 13:46:09 -05:00
Daniel Thayer
60b2c5f1fe Add README files for most Bro frameworks
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.  The text for these was mostly just
copied from the existing docs.
2013-10-11 00:19:37 -05:00
Daniel Thayer
0753853726 Fix typos and formatting in the sumstats docs 2013-10-10 23:15:12 -05:00
Robin Sommer
c6de23ebe1 Merge remote-tracking branch 'origin/topic/bernhard/ticket1072'
* origin/topic/bernhard/ticket1072:
  and const 2 more functions
  update hll documentation, make a few functions private and create a new copy constructor.
  fix case where hll_error_margin could be undefined (thanks John)

BIT-1072 #merged
2013-09-18 15:00:06 -07:00
Bernhard Amann
9834755948 fix case where hll_error_margin could be undefined (thanks John) 2013-09-11 12:50:29 -07:00
Seth Hall
7c1dffa66f Fixed an issue with the HLL_UNIQUE SumStats plugin that caused a reporter error. 2013-09-06 15:31:00 -04:00
Jon Siwek
db470a637a Documentation fixes.
This cleans up most of the warnings from sphinx (broken :doc: links,
broxygen role misuses, etc.).  The remaining ones should be harmless,
but not quick to silence.

I found that the README for each component was a copy from the actual
repo, so I turned those in to symlinks so they don't get out of date.
2013-09-03 15:59:40 -05:00
Robin Sommer
6f9d28cc18 Merge branch 'topic/robin/hyperloglog-merge'
* topic/robin/hyperloglog-merge: (35 commits)
  Making the confidence configurable.
  Renaming HyperLogLog->CardinalityCounter.
  Fixing bug introduced during merging.
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  ...
2013-08-31 10:42:42 -07:00
Robin Sommer
295987c8d0 Making the confidence configurable. 2013-08-31 10:34:50 -07:00
Robin Sommer
4dcf8fc0db Merge remote-tracking branch 'origin/topic/bernhard/hyperloglog'
* origin/topic/bernhard/hyperloglog: (32 commits)
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  change plugin after feedback of seth
  Forgot a file. Again. Like always. Basically.
  do away with old file.
  ...
2013-08-30 11:30:05 -07:00
Bernhard Amann
dc9fd36497 Merge remote branch 'origin/master' into topic/bernhard/hyperloglog 2013-08-28 17:48:59 -07:00
Seth Hall
2b78922af8 Added a $unique_max field to Reducers for the SumStats::UNIQUE calculation
- Using the new option in scan.bro and the FTP bruteforce detection.
2013-08-28 00:57:44 -04:00
Bernhard Amann
74f96d22ef Merge remote branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/3rdparty
2013-08-26 12:53:13 -07:00
Seth Hall
ea89e30a9c One more tiny SumStats change to clean up cluster state. 2013-08-26 15:29:27 -04:00
Seth Hall
72d2cd363e Removed the when statement from general use in the sumstats cluster code. 2013-08-26 13:57:42 -04:00
Seth Hall
2091bbbf6f Fixing a problem with resetting sumstats on managers in the wrong location. 2013-08-21 14:47:05 -04:00
Seth Hall
22b1e78ec1 Changing how threshold reseting happens (actually do it on managers!) 2013-08-21 14:08:14 -04:00
Vlad Grigorescu
73a5106bd9 Fix some reporter.log errors by adding a few extra key membership checks. 2013-08-21 07:29:22 -04:00
Bernhard Amann
d83edf8068 Merge remote-tracking branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/NetVar.cc
	src/NetVar.h
	src/SerialTypes.h
	src/probabilistic/CMakeLists.txt
	testing/btest/scripts/base/frameworks/sumstats/basic-cluster.bro
	testing/btest/scripts/base/frameworks/sumstats/basic.bro
2013-08-12 09:47:53 -07:00
Seth Hall
1eadeaec3c Fix a major memory issue in the SumStats framework.
- There are still problems, but this should prevent a deadlock issue
   and help with memory use.
2013-08-03 01:57:51 -04:00
Seth Hall
6b58ef12d7 Still fixing bugs in sumstats updated api cluster support. 2013-08-02 16:53:56 -04:00
Seth Hall
135094428e Hopefully fix the SumStats cluster support. 2013-08-02 16:30:34 -04:00
Seth Hall
7b8073556e Fix the SumStats top-k plugin and test. 2013-08-02 16:30:20 -04:00
Seth Hall
d6edbd27b1 Merge remote-tracking branch 'origin/master' into topic/seth/sumstats-updates 2013-08-02 13:17:48 -04:00
Seth Hall
4f8100774c Updates for SumStats API to deal with high memory stats.
- The code is a mess and will need to be cleaned up, but the
    tests do pass.
2013-08-02 12:44:33 -04:00