zeek/scripts/base
Christian Kreibich 738ce1c235 Bugfix: accurately track Broker buffer overflows w/ multiple peerings
When a node restarts or a peering between two nodes starts over for other
reasons, the internal tracking in the Broker manager resets its state (since
it's per-peering), and thus the message overflow counter. The script layer was
unaware of this, and threw errors when trying to reset the corresponding counter
metric down to zero at sync time.

We now track past buffer overflows via a separate epoch table, using Broker peer
ID comparisons to identify new peerings, and set the counter to the sum of past
and current overflows.

I considered just making this a gauge, but it seems more helpful to be able to
look at a counter to see whether any messages have ever been dropped over the
lifetime of the node process.

As an aside, this now also avoids repeatedly creating the labels vector,
re-using the same one for each metric.

Thanks to @pbcullen for identifying this one!
2025-05-07 17:27:38 -07:00
..
files Copy timestamp from file object 2024-05-17 15:03:06 +02:00
frameworks Bugfix: accurately track Broker buffer overflows w/ multiple peerings 2025-05-07 17:27:38 -07:00
misc Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
packet-protocols Add analyzer registration from VLAN to VNTAG 2025-03-18 11:51:27 -07:00
protocols Merge remote-tracking branch 'origin/topic/timw/update-ct-ca-lists' 2025-04-29 08:53:04 -07:00
utils Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
init-bare.zeek Merge branch 'topic/christian/broker-backpressure-metrics' 2025-04-25 10:04:09 -07:00
init-default.zeek Lay out initial parts for the Storage framework 2025-03-18 09:32:34 -07:00
init-frameworks-and-bifs.zeek Minor comment tweaks for init-frameworks-and-bifs.zeek 2024-10-18 09:56:29 -07:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00