zeek/scripts/base
Christian Kreibich ace5c11048 Bugfix: accurately track Broker buffer overflows w/ multiple peerings
When a node restarts or a peering between two nodes starts over for other
reasons, the internal tracking in the Broker manager resets its state (since
it's per-peering), and thus the message overflow counter. The script layer was
unaware of this, and threw errors when trying to reset the corresponding counter
metric down to zero at sync time.

We now track past buffer overflows via a separate epoch table, using Broker peer
ID comparisons to identify new peerings, and set the counter to the sum of past
and current overflows.

I considered just making this a gauge, but it seems more helpful to be able to
look at a counter to see whether any messages have ever been dropped over the
lifetime of the node process.

As an aside, this now also avoids repeatedly creating the labels vector,
re-using the same one for each metric.

Thanks to @pbcullen for identifying this one!
2025-05-07 17:30:45 -07:00
..
files Copy timestamp from file object 2024-05-17 15:03:06 +02:00
frameworks Bugfix: accurately track Broker buffer overflows w/ multiple peerings 2025-05-07 17:30:45 -07:00
misc Remove unneeded @loads from base/misc/version.zeek 2025-04-08 15:09:44 -07:00
packet-protocols Merge remote-tracking branch 'origin/topic/timw/vntag-in-vlan' 2025-03-18 16:18:13 -07:00
protocols Update mozilla-ca-list.zeek and ct-list.zeek to NSS 3.109 2025-03-18 17:59:01 -07:00
utils Clarify membership in the Site::private_address_space prefix list. [skip ci] 2024-05-04 11:21:26 -07:00
init-bare.zeek Add peer buffer update tracking to the Broker manager's event_observer 2025-04-29 15:08:05 -07:00
init-default.zeek utils: Introduce packages.zeek with can_load() helper 2024-02-22 11:41:50 +01:00
init-frameworks-and-bifs.zeek Minor comment tweaks for init-frameworks-and-bifs.zeek 2025-04-08 14:50:28 -07:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00