mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
3f7881a57b
While it seems interesting functionality, this hasn't been documented, maintained or knowingly leveraged for many years. There are various other approaches today, too: * We track the number of event handler invocations regardless of profiling. It's possible to approximate a load_sample event by comparing the result of two get_event_stats() calls. Or, visualize the corresponding counters in a Prometheus setup to get an idea of event/s broken down by event names. * HookCallFunction() allows to intercept script execution, including measuring the time execution takes. * The global call_stack and g_frame_stack can be used from plugins (and even external processes) to walk the Zeek script stack at certain points to implement a sampling profiler. * USDT probes or more plugin hooks will likely be preferred over Zeek builtin functionality in the future. Relates to #3458
12 lines
376 B
Text
12 lines
376 B
Text
# @TEST-EXEC: zeek -b -r $TRACES/wikipedia.trace %INPUT
|
|
# @TEST-EXEC: btest-diff stats.log
|
|
|
|
@load policy/misc/stats
|
|
|
|
event zeek_init()
|
|
{
|
|
# Various fields will be unstable for use in baseline, so use one that is.
|
|
local filter: Log::Filter = [$name="pkt-stats", $include=set("pkts_proc")];
|
|
Log::remove_filter(Stats::LOG, "default");
|
|
Log::add_filter(Stats::LOG, filter);
|
|
}
|