zeek/scripts/base/frameworks
Christian Kreibich 738ce1c235 Bugfix: accurately track Broker buffer overflows w/ multiple peerings
When a node restarts or a peering between two nodes starts over for other
reasons, the internal tracking in the Broker manager resets its state (since
it's per-peering), and thus the message overflow counter. The script layer was
unaware of this, and threw errors when trying to reset the corresponding counter
metric down to zero at sync time.

We now track past buffer overflows via a separate epoch table, using Broker peer
ID comparisons to identify new peerings, and set the counter to the sum of past
and current overflows.

I considered just making this a gauge, but it seems more helpful to be able to
look at a counter to see whether any messages have ever been dropped over the
lifetime of the node process.

As an aside, this now also avoids repeatedly creating the labels vector,
re-using the same one for each metric.

Thanks to @pbcullen for identifying this one!
2025-05-07 17:27:38 -07:00
..
analyzer Remove violating analyzer from services field again 2025-03-04 15:10:49 +00:00
broker Lower listen/connect retry intervals in Broker and the cluster framework to 1sec 2025-04-25 10:22:35 -07:00
cluster Bugfix: accurately track Broker buffer overflows w/ multiple peerings 2025-05-07 17:27:38 -07:00
config config: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
control annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
files Move python signatures to a separate file 2024-12-09 11:08:30 -07:00
input Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
intel intel: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
logging Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
netcontrol netcontrol: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
notice Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
openflow openflow: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
packet-filter Add PacketFilter::remove_exclude function 2024-04-17 21:25:35 +00:00
reporter Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
signatures allow signature actions to be dynamically updated 2023-07-13 17:25:32 -07:00
software frameworks/software: Fix stale value used for stripping 2023-11-17 14:37:28 +01:00
spicy Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
storage Add STORAGE_ prefixes for backends and serializers 2025-04-14 10:11:13 -07:00
sumstats sumstats: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
supervisor Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
telemetry Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
tunnels Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00