mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
3fe930dbf2
Adds base/frameworks/telemetry with wrappers around telemetry.bif and updates telemetry/Manager to support collecting metrics from script land. Add policy/frameworks/telemetry/log for logging of metrics data into a new telemetry.log and telemetry_histogram.log and add into local.zeek by default.
25 lines
939 B
Text
25 lines
939 B
Text
# @TEST-DOC: Test loading of telemetry/log and smoke check the telemetry.log file
|
|
# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
|
|
# @TEST-EXEC: grep 'zeek.*sessions' telemetry.log > telemetry.log.filtered
|
|
# @TEST-EXEC: grep 'zeek.*connection_duration' telemetry_histogram.log > telemetry_histogram.log.filtered
|
|
|
|
# @TEST-EXEC: btest-diff telemetry.log.filtered
|
|
# @TEST-EXEC: btest-diff telemetry_histogram.log.filtered
|
|
|
|
@load frameworks/telemetry/log
|
|
|
|
|
|
global connection_duration_hf = Telemetry::register_histogram_family([
|
|
$prefix="zeek",
|
|
$name="connection_duration",
|
|
$unit="seconds",
|
|
$help_text="Monitored connection duration",
|
|
$bounds=vector(2.0, 3.0, 4.0, 5.0, 6.0, 10.0)
|
|
]);
|
|
|
|
global connection_duration_h = Telemetry::histogram_with(connection_duration_hf);
|
|
|
|
event connection_state_remove(c: connection)
|
|
{
|
|
Telemetry::histogram_observe(connection_duration_h, interval_to_double(c$duration));
|
|
}
|