mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
bec965b66f
- On-demand access to sumstats results through "return from" functions named SumStats::request and Sumstats::request_key. Both functions are tested in standalone and clustered modes. - $name field has returned to SumStats which simplifies cluster code and makes the on-demand access stuff possible. - Clustered results can only be collected for 1 minute from their time of creation now instead of time of last read. - Thresholds use doubles instead of counts everywhere now. - Calculation dependency resolution occurs at start up time now instead of doing it at observation time which provide a minor cpu performance improvement. A new plugin registration mechanism was created to support this change. - AppStats now has a minimal doc string and is broken into hook-based plugins. - AppStats and traceroute detection added to local.bro
12 lines
No EOL
295 B
Text
12 lines
No EOL
295 B
Text
@load ../main
|
|
|
|
module AppStats;
|
|
|
|
hook add_sumstats(id: conn_id, hostname: string, size: count)
|
|
{
|
|
if ( /\.gmail\.com$/ in hostname && size > 20 )
|
|
{
|
|
SumStats::observe("apps.bytes", [$str="gmail"], [$num=size]);
|
|
SumStats::observe("apps.hits", [$str="gmail"], [$str=cat(id$orig_h)]);
|
|
}
|
|
} |