zeek/scripts
Christian Kreibich 446f49e6bc Switch Broker's default backpressure policy to drop_oldest, bump buffer sizes
At every site where we've dug into backpressure disconnect findings, it has been
the case that the default values were too small. 8192, so 4x the old default,
suffices at every site to drown out premature disconnects.

With metrics now available for the send buffers regardless of backpressure
overflow policy, this also switches the default from "disconnect" to
"drop_oldest" (for both peers and websockets), meaning that peerings remain
untouched but the oldest queued message simply gets dropped when a new message
is enqueued. With this policy, the number of backpressure overflows is then
simply the count of discarded messages, something that users can tune to see
drop to zero in everyday use.  Another benefit is that marginal overflows cause
less message loss than when an entire buffer's worth (plus potentially more
in-flight messages) gets thrown out with a disconnect.

(cherry picked from commit 841a40ff88)
2025-04-29 16:47:13 -07:00
..
base Switch Broker's default backpressure policy to drop_oldest, bump buffer sizes 2025-04-29 16:47:13 -07:00
policy Merge branch 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek 2024-11-19 09:33:22 -07:00
site telemetry: Deprecate prometheus.zeek policy script 2024-07-23 10:05:46 +02:00
spicy Spicy: Provide runtime API to access Zeek-side globals. 2024-06-20 12:02:54 +02:00
zeekygen test-all-policy: Do not load iso-9660.zeek 2024-02-26 17:58:26 +01:00
CMakeLists.txt Use the same rules as cmake submodule to reformat Zeek 2023-05-09 08:31:43 -07:00
test-all-policy.zeek test-all-policy: Do not load iso-9660.zeek 2024-02-26 17:58:26 +01:00