zeek/scripts/base/frameworks
Christian Kreibich ace5c11048 Bugfix: accurately track Broker buffer overflows w/ multiple peerings
When a node restarts or a peering between two nodes starts over for other
reasons, the internal tracking in the Broker manager resets its state (since
it's per-peering), and thus the message overflow counter. The script layer was
unaware of this, and threw errors when trying to reset the corresponding counter
metric down to zero at sync time.

We now track past buffer overflows via a separate epoch table, using Broker peer
ID comparisons to identify new peerings, and set the counter to the sum of past
and current overflows.

I considered just making this a gauge, but it seems more helpful to be able to
look at a counter to see whether any messages have ever been dropped over the
lifetime of the node process.

As an aside, this now also avoids repeatedly creating the labels vector,
re-using the same one for each metric.

Thanks to @pbcullen for identifying this one!
2025-05-07 17:30:45 -07:00
..
analyzer Add logging of disabled analyzers to analyzer.log 2024-07-09 18:22:43 +02:00
broker Use Broker peering directionality when re-peering after backpressure overflows 2025-04-29 17:00:50 -07:00
cluster Bugfix: accurately track Broker buffer overflows w/ multiple peerings 2025-05-07 17:30:45 -07:00
config Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'" 2023-05-31 09:20:33 +02:00
control annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
files Fix cid propagation into files.log 2024-04-29 14:13:19 +01:00
input More bro-to-zeek renaming in scripts and other files 2019-05-16 02:36:41 -05:00
intel Fix markup typo in the Intel::seen_policy hook docstring [skip ci] 2024-02-02 12:30:39 -08:00
logging logging: Do not keep delay state persistent 2023-11-29 11:53:11 +01:00
netcontrol Netcontrol: add rule_added_policy 2024-02-05 18:52:27 +00:00
notice http: Prevent request/response de-synchronization and unbounded state growth 2023-08-28 15:02:58 +02:00
openflow Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'" 2023-05-31 09:20:33 +02:00
packet-filter Add PacketFilter::remove_exclude function 2024-04-17 21:25:35 +00:00
reporter Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
signatures allow signature actions to be dynamically updated 2023-07-13 17:25:32 -07:00
software frameworks/software: Fix stale value used for stripping 2023-11-17 14:37:28 +01:00
spicy Merge remote-tracking branch 'origin/topic/robin/gh-3881-spicy-ports' 2024-08-30 13:26:16 -07:00
sumstats Remove script functions marked as unused (6.1 deprecations) 2023-06-14 10:07:22 -07:00
supervisor Management framework: add metrics port in management & Supervisor node records 2024-07-08 23:05:24 -07:00
telemetry Telemetry framework: move BIFs to the primary-bif stage 2025-04-08 14:50:45 -07:00
tunnels Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00