zeek/scripts
Christian Kreibich 738ce1c235 Bugfix: accurately track Broker buffer overflows w/ multiple peerings
When a node restarts or a peering between two nodes starts over for other
reasons, the internal tracking in the Broker manager resets its state (since
it's per-peering), and thus the message overflow counter. The script layer was
unaware of this, and threw errors when trying to reset the corresponding counter
metric down to zero at sync time.

We now track past buffer overflows via a separate epoch table, using Broker peer
ID comparisons to identify new peerings, and set the counter to the sum of past
and current overflows.

I considered just making this a gauge, but it seems more helpful to be able to
look at a counter to see whether any messages have ever been dropped over the
lifetime of the node process.

As an aside, this now also avoids repeatedly creating the labels vector,
re-using the same one for each metric.

Thanks to @pbcullen for identifying this one!
2025-05-07 17:27:38 -07:00
..
base Bugfix: accurately track Broker buffer overflows w/ multiple peerings 2025-05-07 17:27:38 -07:00
policy Fix policy/protocols/conn/failed-service-logging.zeek 2025-05-06 13:37:12 +01:00
site telemetry: Deprecate prometheus.zeek policy script 2024-07-21 17:49:21 +02:00
spicy Spicy: Document lifetime semantics of Zeek analyzers created from Spicy. 2025-04-10 12:17:05 +02:00
zeekygen zeekygen: Disable Cluster::Experimental module 2024-12-13 10:03:44 +01:00
CMakeLists.txt Use the same rules as cmake submodule to reformat Zeek 2023-05-09 08:31:43 -07:00
test-all-policy.zeek Redis: Add new backend 2025-03-18 09:32:34 -07:00